Remember back when Elon Musk was handed the keys of our federal government with basically zero accountability or oversight? All sorts of bad stuff happened, but one of the lawsuits we’ve been covering was the American Federation of Gov’t Employees (AFGE) along with the Association of Administrative Law Judges and a few individual federal workers suing DOGE over the fact that Musk’s team of unqualified DOGE boys demanded, and then received, access to information about millions of federal employees from the Office of Personnel Management (OPM). This is highly sensitive data (remember the seriousness of the OPM hack by China? Sorry, the multiple OPM hacks?) that OPM is not supposed to share with anyone who lacks a demonstrated need to know, even within the federal government.
AFGE sued on behalf of their members, all federal government employees, whose data was put at risk. And while Musk is long out of the government and many of the DOGE bros have also left the government, the lawsuits have continued to move forward, including an initial ruling last June that granted a preliminary injunction. But litigation takes time, and going from the preliminary injunction to motions for summary judgment took basically another year.
And this week there was another big (if late) victory. Judge Denise Cote in the Southern District of New York found that OPM violated the Privacy Act by handing DOGE access to the sensitive data of tens of millions of federal employees. Indeed, the sharing of the information was so obviously illegal and egregious that the government effectively offered no defense other than “we’re no longer sharing such info.” As the court notes:
At this point, there is no meaningful dispute concerning the underlying conduct. The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary. The Court therefore reaches the same conclusions on the merits of the plaintiffs’ APA claims for the reasons stated in the June 9 Opinion, which are incorporated here. OPM’s decision to grant DOGE Agents broad access to its systems of records containing PII without a demonstrated need was unlawful; because all the access permissions have been rescinded, those permissions need not be set aside.
Admittedly, this is at odds with the Fourth Circuit (NY is in the Second Circuit), which felt bound to let DOGE have access to Social Security data because the Supreme Court… rejected an earlier injunction with zero explanation in a perplexingly stupid shadow docket non-ruling. The main difference here is OPM data vs. Social Security data, but with this Supreme Court, who the hell knows.
As for this case, for those who will argue that because Trump declared that DOGE was there to modernize the federal government, DOGE was free to access whatever information it needed, that’s not at all how any of this works. Even taking that modernization mandate at face value, nothing about it required access to this much private information. Indeed, the judge points out that the government provides nothing to show that DOGE needed this data for “modernization” efforts.
In their briefing, the defendants reiterate their argument that the nature of the DOGE Agents’ modernization responsibilities under the DOGE Executive Order provided the necessary justification for access to OPM records systems. But the June 9 Opinion already concluded that “IT modernization does not necessarily require access to confidential PII,” much less administrative access. 786 F. Supp. 3d at 688. In fact, one of the plaintiffs’ experts, former OPM CIO David Nesting, testified to participating in modernization efforts at two federal agencies without ever obtaining access to PII contained in the systems being modernized. The defendants do not explain why modernization efforts by the DOGE Agents at OPM needed to proceed differently. The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII.
The government, having not even bothered to defend the obviously illegal data sharing, tried instead to argue that the case is moot because (1) they’ve stopped OPM from continuing to share such data and (2) the “DOGE Temporary Organization” officially expired on July 4th, and nearly all of the DOGE bros who had access to the data are long gone. That would be quite the trick: go into government, get access to all sorts of private information illegally, and then as long as you leave the government before the court can finish deliberating you get off free. That’s not how it works. Especially since OPM kept conveniently timing its policy changes to land right before court deadlines (not suspicious at all…)
the timing of OPM’s revisions to its policies closely tracks this litigation’s deadlines, suggesting that they are driven more by a desire to resolve this case than by a genuine departure from its prior conduct…. OPM repeatedly removed access permissions for the DOGE Agents shortly before court reports were due. OPM circulated its November 2025 policy days before its mootness motion was due. It revised its policies again amid summary judgment briefing and settlement negotiations. And Starr, OPM’s third CIO since this case began, at last repudiated the need-tobe-prepared justification for granting any type of access to OPM’s systems of records containing PII in a declaration attached to the defendants’ sur-reply. He had repudiated the justification for administrative access only in a declaration submitted just two weeks prior. “To the extent that the voluntary cessation doctrine exists primarily to keep parties from acting strategically to avoid judicial review,” Ruesch v. Comm’r of Internal Revenue, 25 F.4th 67, 71 (2d Cir. 2022), OPM’s behavior, while undoubtedly commendable, appears designed to do just that.
The court also notes that DOGE hasn’t fully disappeared, and that at least one person tied to this mess, Senior Advisor Noah Peters, is still at OPM:
That said, the DOGE Executive Order provides that the Organization’s termination does not “imply the termination, attenuation, or amendment of any other authority or provision of this order.” USDS continues to operate within the Executive Office of the President, and the Executive Order’s directive that agencies give USDS “full and prompt access” to their records remains in effect. The termination thus narrows, but does not eliminate, the circumstances in which the challenged conduct could recur.
Lastly, Peters remains at OPM. The parties dispute whether he was an OPM employee or detailed from USDS during the relevant period. Although Peters currently does not have access permissions to any of OPM’s systems of records containing PII, OPM has committed only that it will not grant him access “except in conformity with” its policies and applicable law. That assurance carries little weight, given that the defendants engaged in the challenged conduct notwithstanding the existence of policies and law prescribing their actions. And even though OPM has strengthened their access protocols considerably in response to this litigation, “it is ultimately no more difficult for OPM to ignore these new protocols than to ignore its old procedures.”
There is still the question of remedies, which will apparently be the next phase of this case. Judge Cote has asked both sides for further briefing about whether a permanent injunction is still needed. OPM says no because they’ve already stopped such information sharing. But the timeline here still matters: DOGE got access to all of this data on day one of the Trump administration. The preliminary injunction didn’t come until June, five months later. And then this final ruling came over a year later.
It’s good that the court refused to let OPM run out the clock by pretending that it no longer mattered since DOGE is gone, but no injunction can unshare the data that the DOGE Bros already took. OPM insists that its own review says that the DOGE Bros didn’t exfiltrate the data they got access to outside of OPM, but we have no reason to trust them. They’ve lied before.
Either way, this data is the kind of thing OPM used to insist was fully locked down, and then suddenly it wasn’t once Elon Musk came to town. After the OPM hacks a decade ago, the government swore that it understood how dangerous it was to let this information out. But then Trump and Elon handed the keys to a group of cocky, inexperienced tech bros with basically no limits. And it took the court nearly two years to say, officially, that this was illegal.
That seems like an unworkable system when you have a situation — as we did — where the federal government is taken over by those dead set on looting it as quickly as possible.
