A filing before a United States federal court has alleged that the Nigerian government pays $750,000 monthly to DCI Group AZ, LLC, an affiliate associated with American public affairs and lobbying firm DCI Group, amid an ongoing legal dispute involving President Bola Tinubu and a request for limited discovery.
The allegation was contained in a filing submitted on October 8, 2026, by American transparency activist Aaron Greenspan in his Freedom of Information Act (FOIA) lawsuit against US government agencies over records relating to an alleged federal investigation in the early 1990s involving Tinubu and Abiodun Agbele, reports SaharaReporters.
Greenspan filed a request for judicial notice in support of his motion seeking permission to pursue limited discovery involving Tinubu, who intervened in the lawsuit in October 2023.
According to the filing, DCI Group AZ, LLC, receives $750,000 monthly from the government of the intervenor, a reference to the Nigerian government in the context of the case.
The filing also alleges that an account managed by the DCI affiliate published a post attacking Greenspan on August 5, 2026.
However, the documents cited in the filing do not establish that the Nigerian government directed or financed the alleged online attack or that the reported monthly payments were connected to it.
Quoting allegations attributed to US federal prosecutors, the filing stated: “Federal prosecutors have alleged that a Washington ‘public affairs’ and ‘lobbying’ firm engaged Israeli contractors whose operator(s) directed the hacking of electronic accounts belonging to targets of a project for the lobbying firm’s client, and that hacked data was then provided to the lobbying firm.”
It added that the US Department of Justice, a defendant’s counsel in the United Kingdom and two national news organisations had identified the firm involved in those allegations as DCI Group.
The filing further stated: “DCI Group AZ, LLC is paid $750,000 per month by Intervenor’s government, and on August 5, 2026 an account it manages published a post attacking Plaintiff in writing.”
The allegations form part of Greenspan’s efforts to obtain information relating to himself, the litigation and attacks on his website, PlainSite.
Filing Seeks Judicial Notice of Public Records
Greenspan’s October 8 submission asks the court to take judicial notice of the existence and contents of public records attached to the filing as exhibits.
A separate one-page document submitted alongside the request is labelled a proposed order. Although it contains language granting the request, the copy supplied bears neither a date nor a judicial signature and does not establish that the judge has approved it.
The request for judicial notice is also separate from Greenspan’s underlying application for permission to pursue limited discovery.
Tinubu intervened in the lawsuit in October 2023, citing privacy interests concerning confidential tax records and federal law-enforcement documents.
In April 2025, US District Judge Beryl A. Howell ruled that the Federal Bureau of Investigation and the Drug Enforcement Administration could not maintain their blanket refusals to confirm or deny whether responsive records existed.
The judge, however, upheld the Central Intelligence Agency’s refusal to confirm or deny the existence of records.
The ruling concerned the agencies’ responses to Greenspan’s information requests. It did not establish criminal wrongdoing by Tinubu or order the release of all the records sought by the plaintiff.
Greenspan Seeks Answers Over Alleged Cyberattacks
In September, SaharaReporters reported that Greenspan had asked the federal court in Washington for permission to put four questions to Tinubu concerning a series of denial-of-service attacks on PlainSite.
In a reply filed on September 28 in Greenspan v. Executive Office for U.S. Attorneys, Case No. 1:23-cv-01816-BAH, Greenspan argued that Tinubu had not denied that he, his government or anyone acting on his behalf, including DCI Group AZ, LLC, was involved in the attacks.
“If that is so, the four requests for admission can be answered in minutes,” Greenspan wrote.
The filings, however, do not establish that Tinubu or DCI Group carried out the attacks. They also do not identify the individuals or organisations responsible.
Greenspan Disputes Tinubu’s Argument on Verification
Tinubu’s opposition to Greenspan’s request, filed as ECF No. 109, argued that there was no independent verification of the alleged attacks.
Greenspan rejected the argument, citing a mitigation report attached to his earlier motion. According to his filing, the report was generated on May 29, 2025, by PlainSite’s internet service provider through its own mitigation system.
The report allegedly recorded traffic of 941.9 megabits per second and 1.8 million packets per second at PlainSite’s protected address.
About half of the traffic was identified and dropped as hostile, while 110,700 source hosts were blocked, according to the account presented in Greenspan’s filing.
Greenspan argued that Tinubu’s opposition did not address the report, challenge its authenticity or provide contrary technical evidence.
Greenspan Says Attacks Resumed Around Court Filings
Greenspan also told the court that the alleged attacks resumed after he filed his motion on September 9.
In a supplemental declaration made under penalty of perjury, he said the number of individual addresses blocked by PlainSite’s firewall had fallen to approximately 69,000 by September 7, after the acute attacks stopped in late August.
He alleged that the number began rising sharply around September 18, reached approximately 500,000 on September 23 and stood at 390,957 on the morning of September 24.
Greenspan noted that September 18 was the original deadline for the government’s reply to his summary-judgment cross-motion before the deadline was extended to September 23.
That date also coincided with the filing of submissions by Tinubu’s side and the Justice Department, according to his account.
However, the timing presented in the declaration does not, by itself, establish a connection between the court proceedings and the alleged attacks.
Greenspan further stated that the September attacks were less disruptive than those recorded in August.
Unlike the August incidents, which he said pushed the server’s load average above 300, the September attacks did not overwhelm the server, with the load remaining below 25 because PlainSite’s adaptive firewall automatically identified and blocked attacking networks.
He said the firewall dropped more than 200,000 packets per minute on September 23, while total web traffic exceeded 480,000 packets per minute.
Greenspan explained that some of the largest traffic spikes recorded on September 23 and 24 appeared in the category classified by the firewall as ordinary visitor traffic because attack traffic was counted there before its sources were identified and blocked.
The latest filing adds to Greenspan’s efforts to obtain records and pursue limited discovery in the lawsuit. The allegations concerning the monthly payments, the online attacks and any possible connection between them remain distinct issues that have not been established by the filing itself.
