Opinion for the Court filed by Circuit Judge ROGERS.
ROGERS, Circuit Judge:
The Secretary of the Interior and others ("the Secretary") appeal the preliminary injunction of March 15, 2004, which superseded and replaced an injunction of July 28, 2003, and required disconnection of substantially all of the Department of the Interior's computer systems from the Internet. Cobell v. Norton, 310 F.Supp.2d 77 (D.D.C.2004) ("Cobell XI"). The injunction also requires the Secretary to submit a plan for secure reconnection of Interior's computer systems. In Cobell v. Norton, 240 F.3d 1081 (D.C.Cir.2001) ("Cobell VI"), the court affirmed the district court's finding of a breach of fiduciary duty by the Secretary of the Interior and the other defendants, as trustees of funds held in trust for individual Native Americans (hereafter, "Indians"), in failing to provide an accurate accounting. On remand, the district court entered several injunctive orders mandating Interior to disconnect its computers from the Internet in light of concerns about the security of individual Indian trust data ("IITD"), which are the basis for accounting for Indian funds and are housed on an unknown number of Interior's computer systems. On appeal from the latest injunction entered March 15, 2004, the Secretary contends that the district court exceeded its lawful authority and, alternatively, lacked a factual predicate for the injunction.
We hold, contrary to the Secretary's contention, that issuance of the March 15, 2004 injunction is not precluded by Pub. L. 108-108, 117 Stat. 1241, 1263 (2003), which applies only to "historical accounting activities." As the district court noted, "Interior's present obligation to administer the trust presents sufficient grounds for finding that Plaintiffs will be irreparably injured." Cobell XI, 310 F.Supp.2d at 96 n. 27. We further hold that the district court's jurisdiction properly extends to security
The underlying litigation concerns individual Indian money accounts ("IIM"), which collectively form a trust established by the General Allotment Act in 1887 for the benefit of American Indians.
This court affirmed, although holding in Cobell VI that "the actual legal breach [by the Secretary] is the failure to provide an accounting, not failure to take the discrete individual steps that would facilitate an accounting." 240 F.3d at 1106. Noting Interior's stipulation that it was unable to meet the requirements of "numerous provisions" of the 1994 Act, the court observed that "the federal government will be unable to provide an adequate accounting without computer systems, staffing, and document retention policies that are adequate for the task." Id. The court also stated there was "no need to alter the district court's order [in Cobell V]" because while:
Id. at 1109 (citing In re Center for Auto Safety, 793 F.2d 1346, 1354 (D.C.Cir.1986)). The court added: "[n]onetheless, we expect the district court to be mindful of the limits of its jurisdiction." Id. at 1110.
On remand, as relevant here, the district court, in light of the Special Master's recommendation regarding inadequate IT security of IITD, granted the plaintiffs'
On June 26, 2003, the plaintiffs filed a motion for a temporary restraining order and a preliminary injunction to mandate the Secretary to disconnect from the Internet all Interior computers and IT systems that house or access IITD until the Special Master certified that all the data was properly secured. Id. at 119. Following a hearing, the district court entered a temporary restraining order, modifying the order in light of Interior's suggestions. Interior, while protesting entry of any order, stated that it was willing to work things out with the Special Master. Id. at 120. Soon thereafter, however, Interior requested that "`Special Master Balaran ... be disqualified from acting in any capacity in this case.'" Id. at 124. Following a hearing on July 28, 2003, the district court entered a preliminary injunction, and stayed the Consent Order. Id. at 133. The July 28, 2003 injunction called for disconnection of all Interior computers from the Internet, except: (1) "those essential for protection against fires or other threats to life or property;" and (2) those that [Interior] certified "in accordance with Rule 11 of the Federal Rules of Civil Procedure," were secure from unauthorized Internet access or did not house or access IITD. Id. at 135-36. In light of Interior's objection to any further involvement by the Special Master in determining the security of Interior's IT systems, the district court decided to make the determinations itself. Id. at 133. The Secretary appealed.
In the interim, on August 11, 2003, the Secretary filed certifications on the state of IT security in response to the July 28, 2003 injunction. On March 15, 2004, the district court entered a preliminary injunction that "supersede[d] and replace[d]" the July 28, 2003 injunction. Cobell v. Norton, 310 F.Supp.2d 98, 99 (D.D.C.2004) ("Cobell XI (Order)"). The March 15, 2004 injunction called for disconnection from the Internet of all Interior computers, with exceptions for (1) systems essential to protect against fire or other threats to life or property, and (2) IT systems of the National Park Service, the Office of Policy Management and Budget, and the United States Geological
The Secretary challenges the March 15, 2004 injunction as lacking any legal foundation or factual predicate. According to the Secretary, the injunction lacks a legal basis in the 1994 Act, is contrary to the mandate in Cobell VI, and violates settled limitations on judicial review. Not only did the district court fail to amend its 1999 order in Cobell V in compliance with Cobell VI, 240 F.3d at 1106, but by ordering sweeping equitable relief calling for wholesale improvement of Interior's IT systems security, the district court exceeded its authority under the APA and violated separation of powers principles. Moreover, in the Secretary's opinion, Pub. L. No. 108-108 removed any legal basis for the injunctions.
The court reviews the grant of a preliminary injunction for abuse of discretion. Doran v. Salem Inn, Inc., 422 U.S. 922, 931-32, 95 S.Ct. 2561, 45 L.Ed.2d 648 (1975); Serono Labs., Inc. v. Shalala, 158 F.3d 1313, 1318 (D.C.Cir.1998). The district court's legal conclusions are subject to "essentially de novo review," City of Las Vegas v. Lujan, 891 F.2d 927, 931 (D.C.Cir.1989), while its findings of fact, which include the district court's assessment of whether the Secretary has taken sufficient actions to fulfill her fiduciary duties and to comply with court orders, are reviewed for clear error, id. Upon de novo review of the Secretary's challenges to the district court's authority, we hold that the district court possessed authority on remand from Cobell VI to issue a preliminary injunction regarding IT security.
As a threshold matter, the Secretary's contention that Pub. L. No. 108-108 removes any legal basis for the March 15, 2004 injunction is unpersuasive. This statute provides that nothing in any law "shall be construed or applied to require ... Interior to commence or continue historical accounting activities...." 117 Stat. at 1263. As such, the plain text of the statute addresses only the historical accounting activities required by the district court's September 2003 structural injunction, Cobell X, 283 F.Supp.2d 66, rather than the Secretary's current trust obligations addressed in the March 15, 2004 injunction. It is indisputable that the Secretary has current and prospective trust
The Secretary's other challenges to the district court's legal authority to enter the March 15, 2004 injunction are also unpersuasive. In contending that the district court ignored the narrow mandate of Cobell VI by undertaking to oversee Interior's computer security, the Secretary relies on this court's re-characterization of the legal breach of fiduciary duty in Cobell VI as a failure to provide an accounting, not the separate steps directed by the district court toward facilitating an accounting, and on this court's expectation that the district court would "be mindful of the limits of its jurisdiction." Id. at 1106, 1110. But the Secretary ignores relevant discussion in Cobell VI. The court made plain in Cobell VI that it was "premature ... to rule on the precise scope of the district court's planned proceedings" in addressing the difficult task of extracting an accounting from an agency with an intransigent past. Id. at 1110. The court likewise made plain that maintaining adequate computer systems, along with staff and document retention policies, is critical to the completion of an adequate accounting. Id. at 1106. While the court also stated that Interior "should be afforded sufficient discretion in determining the precise route [it] take[s], so long as this threshold [of producing an adequate accounting] is met," id., the court did not limit the district court's authority to exercise its discretion as a court of equity in fashioning a remedy to right a century-old wrong or to enforce a consent decree, see Frew v. Hawkins, 540 U.S. 431, 124 S.Ct. 899, 905, 157 L.Ed.2d 855 (2004). The court merely suggested that the district court should grant the Secretary some leeway in fashioning solutions, and the district court's memorandum opinion accompanying the injunction reflects this approach.
Contrary to the Secretary's view, "[w]hile the government's obligations are rooted in and outlined by the relevant statutes and treaties, they are largely defined in traditional equitable terms," Cobell VI, 240 F.3d at 1099, and the narrower judicial powers appropriate under the APA do not apply. Jicarilla Apache Tribe v. Supron Energy Corp., 728 F.2d 1555, 1567 (10th Cir.1984) (Seymour, J., concurring in part and dissenting in part), adopted as majority opinion as modified en banc, 782 F.2d 855 (10th Cir.1986). Although the APA is the device whereby sovereign immunity was waived in this case, Cobell VI, 240 F.3d at 1094-95, and the court considered whether final agency action was involved, id. at 1095, the Secretary has an "`overriding duty ... to deal fairly with Indians,'" id. at 1099 (quoting Morton v. Ruiz, 415 U.S. 199, 236, 94 S.Ct. 1055, 39 L.Ed.2d 270 (1974)), and the Secretary's actions must be judged by "`the most exacting fiduciary standards,'" id. (quoting Seminole Nation v. United States, 316 U.S. 286, 297, 62 S.Ct. 1049, 86 L.Ed. 1480 (1942)), in this litigation. The Secretary cannot now try to "`escape h[er] role as trustee by donning the mantle of administrator' to claim that courts must defer to h[er] expertise and delegated authority." Cobell VI, 240 F.3d at 1099 (quoting Jicarilla, 728 F.2d at 1567). The district court, then, retains substantial latitude, much more so than in the typical agency case, to fashion an equitable remedy because the underlying lawsuit is both an Indian case and a trust case in which the trustees have egregiously breached their fiduciary
It is only by mischaracterizing the March 15, 2004 injunction that the Secretary can now contend that the district court dictated Interior's actions for improving IT system security, and therefore violated the separation of powers. The plain language of the injunction as well as the district court's memorandum opinion requires the Secretary to develop the IT security programs. The district court did not order the type of wholesale programmatic changes rejected in Lujan v. National Wildlife Federation, 497 U.S. 871, 891, 110 S.Ct. 3177, 111 L.Ed.2d 695 (1990), and Cobell VI, 240 F.3d at 1095. Nor does the injunction include particular tasks for Interior to perform based on policies developed by the district court, as in Cobell V. Cobell VI, 240 F.3d at 1105-06. The injunction does no more than ensure that the Secretary is "tak[ing] reasonable steps toward the discharge of the federal government's fiduciary obligations to IIM trust beneficiaries...." Id. at 1106. The district court has limited its role to accepting or rejecting the Secretary's proposals, rather than dictating their substance or even the standard for measuring the security of Interior's IT systems. Cobell XI (Order), 310 F.Supp.2d at 101. Given the admissions in the Consent Order of Interior's past gross computer security failures, and the "impasse" between the parties regarding the manner in which the Consent Order should be implemented, Cobell IX, 274 F.Supp.2d at 126, the district court had authority to require the Secretary to propose a workable plan in order "to ensure that its instructions are followed." Cobell VI, 240 F.3d at 1109.
We do not reach the merits of the Secretary's challenges to the factual predicate for the March 15, 2004 injunction because related procedural and evidentiary issues require that we vacate the injunction.
A preliminary injunction is an extraordinary remedy that should be granted only when the party seeking the relief, by a clear showing, carries the burden of persuasion. Mazurek v. Armstrong, 520 U.S. 968, 972, 117 S.Ct. 1865, 1866-67, 138 L.Ed.2d 162 (1997). To prevail, the moving party must demonstrate (1) a substantial likelihood of success on the merits, (2) that it would suffer irreparable harm without injunctive relief, (3) that an injunction would not substantially harm other interested parties, and (4) that issuance of the injunction is in the public interest. Serono Labs., Inc. v. Shalala, 158 F.3d 1313, 1317-18 (D.C.Cir.1998); CityFed Fin. Corp. v. Office of Thrift Supervision, 58 F.3d 738, 746 (D.C.Cir.1995); see also FED.R.CIV.P. 65(a).
The district court, in entering the July 28, 2003, preliminary injunction found, after a hearing, that:
Cobell IX, 274 F.Supp.2d at 132. The district court concluded injunctive relief was warranted, and adopted a "middle ground," between disconnecting all the reconnected systems and allowing continued connection of potentially unsecured systems, by ordering the Secretary to submit certifications explaining why each IT system housing or accessing IITD was secure. Id. at 132. In entering the March 15, 2004 injunction, the district court also found that the "plaintiffs have already prevailed on the merits in both the first phase and phase 1.5 of this litigation," and thus "have demonstrated a substantial likelihood" of success on the merits. Cobell XI, 310 F.Supp.2d at 95 (citing Cobell V, 91 F.Supp.2d 1; Cobell VI, 240 F.3d 1081; and Cobell X, 283 F.Supp.2d 66).
Prevailing on the merits of the liability claim of a breach of fiduciary duty by the Secretary in failing to account for IITD funds did not relieve the plaintiffs of their burden as the moving party to demonstrate the necessity of the IT disconnection injunction to safeguard against imminent and irreparable injury to their interests. The district court in Cobell V contemplated that the post-liability phase of the underlying litigation would, in part, "involve the government bringing forward its proof on IIM trust balances and then plaintiffs making exceptions to that proof." 91 F.Supp.2d at 31. Given Interior's superior access to information about the state of its IT system security, this was a reasonable way to proceed in evaluating the plaintiffs' request for injunctive relief to disconnect IT systems. Cf. Office of Workers' Comp. Programs v. Greenwich Collieries, 512 U.S. 267, 274, 114 S.Ct. 2251, 2256, 129 L.Ed.2d 221 (1994). But it was error to shift the burden of persuasion to the Secretary to show why disconnecting most of Interior's IT systems was unnecessary to ensure the security of IITD, and the error was not harmless. See 28 U.S.C. § 2111; FED.R.CRIM.P. 52(a); cf. Barth v. Gelb, 2 F.3d 1180, 1188 (D.C.Cir.1993) (citing Williams v. U.S. Elevator Corp., 920 F.2d 1019, 1023 (D.C.Cir.1990)).
The evidence before the district court consisted of the Special Master's reports documenting vulnerabilities of Interior's IT systems through February 5, 2002, including exposure of IITD "to uninvited review and manipulation," Cobell XI, 310 F.Supp.2d at 81, and identifying "many problems that were not fixed." Id. at 81 n. 6. The Special Master also reported results from continued penetration testing in February and March 2003. Three external reports — a House Committee report, an Interior Report to the Office of Management and Budget, and a report by the General Accounting Office — advised of Interior's and other federal agencies' IT deficiencies. However, the Secretary points out, and the plaintiffs do not dispute, there was no evidence that anyone other than the Special Master's contractor had "hacked" into any Interior computer system housing or accessing IITD. The external reports did not specifically address whether, in March 2004, unauthorized access through the Internet presented an imminent danger to the integrity of IITD, or if Interior's network security compromised the security of IITD. Nonetheless, the district court relied upon these reports as reason to conclude that Interior could not monitor itself or be solely responsible for the security of IITD. Id. at 89-93. In contrast, the Secretary's certifications of August 11, 2003 purported to demonstrate how Interior had rendered its IT systems security adequate to protect IITD. The district court declined to examine the sources for the Secretary's
The Secretary's certifications on IT systems security consisted of twelve declarations and supporting materials. The district court declined to consider them because the declarants stated that the information provided was "true and correct to the best of my knowledge, information and belief," which the district court held contravened Local Rule 5.1(h)
Local Rule 5.1(h) and 28 U.S.C. § 1746 contemplate as adequate certifications that are "substantially" in the form of the language of their provisions. A declaration or certification that includes the disclaimer "to the best of [the declarant's] knowledge, information or belief" is sufficient under the local rule, the statute. See United States v. Roberts, 308 F.3d 1147, 1154-55 (11th Cir.2002), cert. denied, 538 U.S. 1064, 123 S.Ct. 2232, 155 L.Ed.2d 1119 (2003). Moreover, the July 28, 2003 injunction directed only that the certifications be made in accordance with Rule 11 of the Federal Rules of Civil Procedure. Cobell IX, 274 F.Supp.2d at 136. Rule 11(a) provides that "[e]xcept when otherwise specifically provided by rule or statute, pleadings need not be verified or accompanied by affidavit," Fed.R.Civ.P. 11(a), and the district court cited to no other requirement compelling verification. Further, Rule 11(b), which governs "[r]epresentations to the court," explicitly contemplates certifications to "the best of the person's knowledge, information, and belief, formed after an inquiry reasonable under the circumstances...." Fed.R.Civ.P. 11(b). The district court therefore erred in rejecting Interior's submissions as "procedurally ... defective." Cobell XI, 310 F.Supp.2d at 83.
Furthermore, the district court seemed to be insisting on compliance with Rule 56(e) of the Federal Rules of Civil Procedure, which expressly requires affidavits to be based on personal knowledge. But that rule applies to a motion for summary judgment. Here the district court treated the matter as a preliminary injunction proceeding. Nothing in the rules specifies what sort of affidavits are required at the
While internal inconsistencies could provide a basis for discrediting the certifications, the district court cited only one. Id. at 85-86. A statement accompanying the declaration of the Deputy Director for the Bureau of Land Management indicated that the Automated Fluid Mineral Support System had been reconnected, while an attached table indicated the system had "no internet connectivity." Id. at 86. The inconsistency could affect whether the court would give credence to that particular certification, but it did not support disregarding the others, which were prepared and sworn by different people with regard to different bureaus. To the extent the district court also observed that the Secretary was telling a different story about its computer security to other branches of the government, see id. at 89-95, the only issue before the district court was the security of IT systems housing and accessing IITD, and the external reports referenced by the court did not address that precise issue. Consequently, the district court also erred by disregarding Interior's certifications as substantively defective. Id. at 83.
A preliminary injunction may be granted based on less formal procedures and on less extensive evidence than in a trial on the merits, Natural Res. Def. Council v. Pena, 147 F.3d 1012 (D.C.Cir.1998) (quoting Univ. of Texas v. Camenisch, 451 U.S. 390, 395, 101 S.Ct. 1830, 68 L.Ed.2d 175 (1981)), but if there are genuine issues of material fact raised in opposition to a motion for a preliminary injunction, an evidentiary hearing is required, Ty, Inc. v. GMA Accessories, Inc., 132 F.3d 1167 (7th Cir.1997). Particularly when a court must make credibility determinations to resolve key factual disputes in favor of the moving party, it is an abuse of discretion for the court to settle the question on the basis of documents alone, without an evidentiary hearing. See Prakash v. Am. Univ., 727 F.2d 1174, 1181 (D.C.Cir.1984); cf. Dopp v. Franklin Nat'l Bank, 461 F.2d 873 (2d Cir.1972). The circumstances and interests at stake will affect whether an abbreviated or more extensive evidentiary hearing is necessary. See Brock v. Roadway Exp., Inc., 481 U.S. 252, 261, 107 S.Ct. 1740, 1747, 95 L.Ed.2d 239 (1987); Mantek Div. of NCH Corp. v. Share Corp., 780 F.2d 702, 705-06 (7th Cir.1986).
The district court could not resolve the state of Interior's IT systems security without conducting a hearing on the evidence in dispute. In opposition to the plaintiffs' motion for injunctive relief mandating disconnection of Interior's IT systems from the Internet, the Secretary described various measures taken and underway by Interior to secure IT systems, and disputed that such drastic relief was necessary. Almost nine months had passed since the hearing for the July 28,
Accordingly, we vacate the March 15, 2004 injunction and remand the case to the district court.