A federal appeals court ruled Tuesday that the Wikimedia Foundation has standing to challenge a National Security Agency program that siphons communications directly from the internet’s backbone.

U.S. District Judge T.S. Ellis previously dismissed the case in 2015, agreeing with the government that Wikimedia and allied organizations relied on "probabilities and suppositions" and could not show their records were taken.

A three-judge panel of the U.S. Court of Appeals for the 4th Circuit overruled Ellis, writing “there’s nothing speculative about it – the interception of Wikimedia’s communications is an actual injury that has already occurred.”

The Wikimedia Foundation, which manages the popular online encyclopedia Wikipedia, and eight allied groups sued in 2015 alleging the NSA’s Upstream collection program violates First and Fourth Amendment rights and exceeds the NSA’s statutory authority.

Upstream collection is – along with the PRISM program that takes communications from companies like Google and Facebook – a major source of internet records the NSA says it's authorized to acquire through Section 702 of the Foreign Intelligence Surveillance Act, which expires this year if Congress does not renew it.

Upstream collection lifts communications directly from the cables, switches and routers that make up the internet’s backbone.

“To put it simply, Wikimedia has plausibly alleged that its communications travel all of the roads that a communication can take, and that the NSA seizes all of the communications along at least one of those roads,” the appeals judges wrote.

“Thus, at least at this stage of the litigation, Wikimedia has standing to sue for a violation of the Fourth Amendment. And, because Wikimedia has self-censored its speech and sometimes forgone electronic communications in response to Upstream surveillance, it also has standing to sue for a violation of the First Amendment."

Wikimedia argued that because it engages in more than 1 trillion communications a year, if there was even a 0.00000001 percent chance of the NSA intercepting a message, the odds at least one of Wikimedia's communications was intercepted in a one-year span would be greater than 99.9999999999 percent.

The appeals court found the other groups suing alongside Wikimedia, however, do not have standing to sue – as they did not offer enough to show “substantially all” text-based communications entering and leaving the U.S. are being collected.

Judge Andre Davis dissented in part from the decision, writing he believed the non-Wikimedia plaintiffs also “provided enough factual support” to proceed.

“This is an important victory for the rule of law," says Patrick Toomey, an attorney for the American Civil Liberties Union who argued the case.

"The NSA has secretly spied on Americans’ internet communications for years, but now this surveillance will finally face badly needed scrutiny in our public courts," he says. "We look forward to arguing this case on the merits. Our government shouldn’t be searching the private communications of innocent people in bulk, examining the contents of Americans’ emails and chats day in and day out.”

The NSA earlier this year reportedly ended a part of its Upstream collection program that collected Americans' communications with people overseas if they mentioned a specific targeted term, but weren't sent directly to or from a foreign surveillance target.

The NSA follows procedures to minimize collection of extraneous information about "U.S. persons" – citizens, legal residents, corporations or groups – but Wikimedia argues in its lawsuit they are “feeble,” with intercepts stored three years by default and forever if encrypted.

Efforts to impose a warrant requirement on communications about Americans that were "incidentally" collected under Section 702 have failed in Congress.

Months before explosive leaks about NSA surveillance by whistleblower Edward Snowden, the U.S. Supreme Court in 2013 struck down a challenge to the legality of Section 702 collection, ruling in Clapper v. Amnesty International that privacy advocates "relie[d] on a highly attenuated chain of possibilities, [which did] not satisfy the requirement that threatened injury must be certainly impending."

The 4th Circuit ruling, which leans heavily on post-Snowden official disclosures, including a Privacy and Civil Liberties Oversight Board report, found Tuesday that "Clapper’s analysis of speculative injury does not control this case, since the central allegations here are not speculative."

Cindy Cohn, executive director of the Electronic Frontier Foundation, which in 2011 won a standing argument before the U.S. Court of Appeals for the 9th Circuit in its own long-running challenge against NSA surveillance, called the decision a partial victory.

EFF’s case Jewel v. NSA began after AT&T whistleblower Mark Klein exposed details about a secret room at a San Francisco facility and is pending before a trial court, where the group is fighting for additional information about the scope of surveillance.

The 4th Circuit decision shows judges are “willing to take seriously the impact mass surveillance of the internet backbone has on ordinary people,” Cohn says.