Aaron Greenspan, the American plaintiff suing the FBI and the Drug Enforcement Administration (DEA) for the release of decades-old records connected to President Bola Ahmed Tinubu, has asked a federal judge in Washington, DC, for permission to formally question Tinubu and a US lobbying firm paid by the Nigerian government over repeated cyberattacks on his website.
The request was filed on September 9, 2026, in the US District Court for the District of Columbia. It is separate from, but connected to, Greenspan’s ongoing lawsuit seeking the release of 1990s US law-enforcement records relating to Tinubu.
Greenspan does not accuse Tinubu of ordering the attacks. No court has made such a finding. Instead, he is asking Judge Beryl A. Howell for permission to question Tinubu and obtain documents from DCI Group AZ, L.L.C., a Washington public affairs firm registered as an agent of the Nigerian government.
Greenspan’s request
Greenspan is asking the court for permission to send Tinubu six written questions, four requests for admission and one request for documents.
He also wants the court to issue a subpoena compelling DCI Group to produce documents.
Greenspan said he first approached Tinubu’s lawyers, who rejected the request, arguing that the questions “would not be proper in a FOIA action, is not related to the issue in the case, and discovery is not a tool of personal investigation.”
gov.uscourts.dcd_.256792.105.2.pdf
According to Greenspan, the FBI and DEA did not respond to his request.
Repeated attacks on PlainSite
Greenspan operates PlainSite, a legal research website that also publishes records from his lawsuit.
According to a declaration filed with the court, PlainSite has been hit by repeated distributed denial-of-service (DDoS) attacks since April 2025. Such attacks flood a website with large volumes of traffic in an attempt to prevent legitimate users from accessing it.
Greenspan says his technical records show that the attacks were substantial. At their peak, his monitoring system recorded about 1 gigabit per second and 1.8 million packets per second of traffic from more than 110,000 source hosts simultaneously.
He said some attacks in August 2026 were severe enough to push his server’s “load average” above 500, compared with 100, which he described as already representing severely degraded performance.
Greenspan says the traffic was consistent with a botnet known as Aisuru-Kimwolf, which uses compromised devices to generate attack traffic.
But he stresses that identifying the botnet does not identify the person behind an attack.
Why Greenspan says the timing matters
Greenspan’s main argument is based on the timing of the attacks and developments in his lawsuit.
gov.uscourts.dcd_.256792.105.0.pdf
He says sustained attacks began three days after the court issued an April 8, 2025 order directing the release of some records and repeatedly occurred around significant filings and deadlines in the case.
He said the heaviest attack in August began on August 6, four days before a scheduled filing deadline, and further attacks occurred around filings by Tinubu and the US government later that month.
The acute attacks stopped after August 31, according to his filing.
Greenspan acknowledges that the timing does not establish who was responsible.
“Correlation is not attribution,” he states, while arguing that the pattern shows someone was “watching this case closely” and had “a strong incentive to prevent public access to case and case-related materials.”
Nigerian government-linked lobbying firm
Greenspan’s request also focuses on DCI Group AZ.
A December 18, 2025 filing under the US Foreign Agents Registration Act (FARA) identified DCI Group as an agent of “the Republic of Nigeria through Aster Legal.”
The filing says the firm’s work for Nigeria includes helping the country “communicate its actions to protect Nigeria’s Christian communities and maintain U.S. support in countering West African jihadist groups and other destabilizing elements.”
It also disclosed a $4.5 million payment to DCI Group on December 12, 2025, covering the first six months of an agreement providing for payments of $750,000 per month.
gov.uscourts.dcd_.256792.105.1.pdf
Greenspan says DCI Group’s work was directed by Nigeria’s National Security Adviser, Nuhu Ribadu.
The filing also points to an August 5, 2026 post by an X account called “Secure Nigeria,” whose profile states that it “is managed by DCI Group AZ, L.L.C., on behalf of the Republic of Nigeria.”
The account described Greenspan as “the latest in a long line of comedic characters that have aligned with the opposition seeking to oust President Tinubu” and asked, “why is anyone listening to Greenspan and his ramblings?”
Greenspan says the most intense sustained DDoS attack he recorded began the following day and continued from August 6 to August 9.
However, he expressly states that he is not alleging that DCI Group was responsible for the attacks.
Reports cited but not independently verified
Greenspan also cited two reports by Peoples Gazette, while stating that he “cannot vouch for” them.
One report alleged that the Nigerian government had entered contracts worth millions of dollars with US public relations and lobbying firms to manage international perceptions of Tinubu.
Another report published in September 2026 said a Washington lobbying firm working for former Vice President Atiku Abubakar’s campaign to secure release of the records had alleged that someone connected to Tinubu offered its founder $3 million to abandon the campaign. The firm said it would refer the matter to the FBI and Department of Justice.
Greenspan cited the reports as part of the circumstances surrounding his request, rather than as established facts.
What Greenspan wants to know
If the judge grants the request, Greenspan wants Tinubu to answer whether he, the Nigerian government or anyone acting on his behalf directed, funded, authorised or facilitated attacks on PlainSite.
He also wants information about firms retained in connection with the case or Greenspan, including their identities, payments and communications.
His proposed subpoena would require DCI Group to produce documents relating to Greenspan, PlainSite, the lawsuit, the August 5 X post and any communications concerning DDoS attacks or services used to generate such attacks.
Greenspan is not asking for a deposition.
As of the filing, there had been no public ruling on the request. The filing also does not establish that Tinubu, the Nigerian government or DCI Group had any role in the cyberattacks.
The case is before Judge Beryl A. Howell in the US District Court for the District of Columbia.