Pluralistic: EFF's lawsuit against DOGE will go forward (09 Apr 2025)


Today's links


A giant in a tailcoat whose head is the glaring eye of HAL 9000 from Kubrick's '2001: A Space Odyssey,' surmounted by Trump's hair. The giant peers through a magnifying glass at three barefooted children, standing in his palm. The background is the Office of Personnel Management logo superimposed over a giant eyeball.

EFF's lawsuit against DOGE will go forward (permalink)

In my 23 years at EFF, I've been privileged to get a front-row seat for some of the most important legal battles over tech and human rights in history. There've been tremendous victories and heartbreaking losses, but win or lose, I am forever reminded that I'm privileged to work with some of the smartest, most committed, savviest cyberlawyers in the world.

These days, it's more of a second-row seat – I work remotely, mostly on my own projects, and I rely on our Deeplinks blog as much as our internal message-boards to keep up with our cases. Yesterday, I happened on this fantastic explainer breaking down our most recent court victory, in our case against DOGE on behalf of federal workers whose privacy rights have been violated during DOGE's raid on the Office of Personnel Management's databases:

https://www.eff.org/deeplinks/2025/04/our-privacy-act-lawsuit-against-doge-and-opm-why-judge-let-it-move-forward

The post is by Adam Schwartz, EFF's Privacy Litigation Director. I've been campaigning on privacy for my entire adult life, but I still learn something – something big and important – every time I talk about the subject with Adam. His breakdown on EFF's latest court victory is no exception.

EFF was the first firm to bring a suit directly against DOGE, representing two federal workers' unions: the AFGE and the AALJ, and our co-counsel are from Lex Lumina LLP, State Democracy Defenders Fund, and The Chandra Law Firm. At the heart of our case are the millions of personnel records that DOGE agents were given access to by OPM Acting Director Charles Ezell.

The OPM is like the US government's HR department. It holds files on every federal employee and retiree, filled with sensitive, private data about that worker's finances, health, and personal life. The OPM also holds background check data on federal workers, including the deep background checks that federal workers must undergo to attain security clearances. Many of us – including me – first became familiar with the OPM in 2015, after its records were breached by hackers believed to be working for the Chinese military:

https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach

That breach was catastrophic. Chinese spies stole the sensitive data of tens of millions of Americans. The DOGE breach implicates even more Americans' private data, though, and while DOGE isn't a foreign intelligence agency, that cuts both ways. It's a good bet that a Chinese spy agency will not leak the records it stole, but with DOGE, it's another matter entirely. I wouldn't be surprised to find the OPM data sitting on a darknet server in a month or a year.

In his breakdown, Adam explains the ruling and what was at stake. We brought the case on behalf of all those federal workers under the 1974 Privacy Act, which was passed in the wake of Watergate and the revelations about COINTELPRO, scandals that rocked the nation's faith in federal institutions. The Privacy Act was supposed to restore trust in government, and to guard against future Nixonian enemies lists:

https://tile.loc.gov/storage-services/service/ll/llmlp/LH_privacy_act-1974/LH_privacy_act-1974.pdf

The Privacy Act's preamble asserts that the US government's creation of databases on Americans – including federal workers – "greatly magnified the harm to individual privacy." This is the basis for the Act's tight regulation on how government agencies use and handle databases containing dossiers on the lives of everyday Americans.

The US government tried to get the case tossed out by challenging our clients' "standing" to sue. Only people who have been harmed by someone else has the right ("standing") to sue over it. Does having your data leaked to DOGE constitute a real injury? Two recent Supreme Court cases say it does: Spokeo vs Robins and Transunion vs Ramirez both establish that "intangible" injuries (like a privacy breach) can be the basis for standing.

The court agreed that our clients had standing because the harms we alleged – DOGE's privacy breaches – are "concrete harms analogous to intrusion upon seclusion" ("intrusion upon seclusion" is one of the canonical privacy violations, set out in the Restatement of Torts, the American Law Institute's comprehensive guide to common law).

But the court went further, noting that DOGE's operation is accused of being "rushed and insecure," rejecting DOGE's argument that it only accessed OPM's "system" but not the data stored in that system. The court also said that it wouldn't matter if DOGE accessed the system, but not the data – that merely gaining access to the data violated our clients' privacy. Here, the judge is part of an emerging consensus, joining with four other federal judges who've ruled that when DOGE gains access to a system containing private data, that alone constitutes a privacy violation, even if DOGE doesn't look at or process the records in the system.

So in ruling for our clients, the judge found that the mere fact that DOGE could access their records was an injury that gave us standing to proceed – and also found that there were other injuries that would separately give us standing, including the possibility that DOGE's breach could expose our clients to "hacking, identity theft, and other activities that are substantially harmful."

The US government repeatedly argued that we weren't accusing them of disclosing our clients' records, every time they did this, the judge pointed to our actual filings, which plainly assert that DOGE agents were "viewing, possessing and using" our clients' records, and that this constitutes "disclosure" under the law, and according to OPM's own procedures.

The judge found that we were entitled to seek relief under the Administrative Procedures Act (APA), which proscribes the conduct of federal agencies – and that our relief could be both "declaratory" (meaning a court could rule that DOGE was breaking the law) and "injunctive" (meaning the court could order DOGE to knock it off).

Normally, a plaintiff can't ask for a judgment under the APA until an agency has taken a "final" action. The court found that because DOGE's actions were accused of being "illegal, rushed, and dangerous," and that this meant that we could seek relief under the APA. Further, that we could invoke the APA here because the remedies set out in the Privacy Act itself wouldn't be sufficient to help our clients in the face of DOGE's mass data-plundering.

Finally, the court ruled that our claims will allow us to pursue APA cases because OPM and DOGE were behaving in an "arbitrary and capricious" manner, and exceeding its legal authority.

All of this is still preliminary – we're not at the point yet where we're actually arguing the case. But standing is a huge deal. Ironically, it's when governments violate our rights on a mass scale that standing is hardest to prove. Our Jewel case, over NSA spying, foundered because the US government argued that we couldn't prove our clients had been swept up by NSA surveillance because the details of that surveillance were officially still secret, even though Snowden had disclosed their working a decade earlier, and our client Mark Klein (RIP) had come forward with documents on illegal mass NSA spying in 2006!:

https://www.eff.org/deeplinks/2022/06/effs-flagship-jewel-v-nsa-dragnet-spying-case-rejected-supreme-court

So this is a big deal. It means we're going to get to go to court and argue the actual merits of the case. Things are pretty terrible right now, but this is a bright light. It makes me proud to have spent most of my adult life working with EFF. If you want to get involved with EFF, check and see if there's an Electronic Frontier Alliance affinity group in your town:

https://efa.eff.org/allies

(Image: Cryteria, CC BY 3.0; EFF, CC BY 4.0; modified)

Hey look at this (permalink)


A Wayback Machine banner.

Object permanence (permalink)

#20yrsago Canadian music industry’s fake stats shredded https://web.archive.org/web/20050410142551/http://firstmonday.org/issues/issue10_4/geist/

#20yrsago American Airlines’ dossier on Cory’s friends: the latest installment https://memex.craphound.com/2005/04/09/american-airlines-dossier-on-corys-friends-the-latest-installment/

#20yrsago Bill Gates 0wns Einstein, Groucho , Freud, Asimov, Fuller, et al https://www.theguardian.com/world/2005/apr/09/arts.film

#20yrsago WIPO Development Agenda proposal scorecard: USA, Mexico, UK all blow it https://web.archive.org/web/20050410234518/http://lists.essential.org/pipermail/a2k/2005-April/000199.html

#15yrsago Canadian copyright consultation: 54 in favor of US/UK-style copyright expansion, 6138 against https://web.archive.org/web/20100412160154/https://www.michaelgeist.ca/content/view/4946/125/

#15yrsago NYT ethicist: OK to pirate ebooks once you’ve bought the hardcover https://www.nytimes.com/2010/04/04/magazine/04FOB-ethicist-t.html?ref=magazine

#15yrsago Minister for Digital Britain thinks an IP address is an “Intellectual Property address” https://imgur.com/i-wrote-to-mp-2-weeks-ago-regarding-de-bill-i-received-this-forwarded-reply-from-mandelsons-bis-department-yesterday-as-response-uks-minister-digital-britain-stephen-timms-doesnt-kn-r-worldnews-2053-april-09-2010-1pXlO

#15yrsago UK ISP TalkTalk will not obey Digital Economy Bill disconnection orders https://web.archive.org/web/20100410122709/https://www.talktalkblog.co.uk/2010/04/08/digital-economy-bill-its-a-wash-up/

#5yrsago Cleveland Plain Dealer executed by union-busting owners https://pluralistic.net/2020/04/08/non-fiscal-payfors/#advance

#5yrsago Nurse suspended for distributing crowdfunded PPE https://pluralistic.net/2020/04/08/non-fiscal-payfors/#olga-matievskaya

#5yrsago Solnit on the revelations of crisis https://pluralistic.net/2020/04/08/non-fiscal-payfors/#solnit

#5yrsago Tails adds Secureboot support https://pluralistic.net/2020/04/09/all-hail-morlocks/#uefi

#5yrsago Kansas GOP nukes ban on large Easter gatherings https://pluralistic.net/2020/04/09/all-hail-morlocks/#gop-death-cult

#5yrsago Philips quadruples ventilator costs https://pluralistic.net/2020/04/09/all-hail-morlocks/#covidiens-revenge

#1yrago Steven Brust's "Lyorn" https://pluralistic.net/2024/04/09/so-meta/#delightful-doggerel

#1yrago How to shatter the class solidarity of the ruling class https://pluralistic.net/2024/04/08/money-talks/#bullshit-walks

Upcoming appearances (permalink)

A photo of me onstage, giving a speech, pounding the podium.


A screenshot of me at my desk, doing a livecast.

Recent appearances (permalink)


A grid of my books with Will Stahle covers..

Latest books (permalink)


A cardboard book box with the Macmillan logo.

Upcoming books (permalink)

  • Enshittification: Why Everything Suddenly Got Worse and What to Do About It, Farrar, Straus, Giroux, October 7 2025
    https://us.macmillan.com/books/9780374619329/enshittification/

  • Unauthorized Bread: a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, 2026

  • Enshittification, Why Everything Suddenly Got Worse and What to Do About It (the graphic novel), Firstsecond, 2026

  • The Memex Method, Farrar, Straus, Giroux, 2026


Colophon (permalink)

Today's top sources:

Currently writing:

  • Enshittification: a nonfiction book about platform decay for Farrar, Straus, Giroux. Status: second pass edit underway (readaloud)

  • A Little Brother short story about DIY insulin PLANNING

  • Picks and Shovels, a Martin Hench noir thriller about the heroic era of the PC. FORTHCOMING TOR BOOKS FEB 2025

Latest podcast: Nimby and the D-Hoppers https://craphound.com/stories/2025/04/06/nimby-and-the-d-hoppers-2/

This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Medium (no ads, paywalled):

https://doctorow.medium.com/

Twitter (mass-scale, unrestricted, third-party surveillance and advertising):

https://twitter.com/doctorow

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla

ISSN: 3066-764X

Join the Discussion at ChinWag