Labor & Employment Law Daily Wrap Up, LITIGATION NEWS, TRENDS—Citing privacy concerns, executive branch employees sue over collection of employee information in unsecure server, (Jan 31, 2025)
Organizations Mentioned:Office of Personnel Management | Secretary of Homeland Security
By Brandi O. Brown, J.D.
According to the complaint, an unsecure email server was used to send test messages to which employees were instructed to respond.
In a lawsuit filed this week in federal district court in the District of Columbia, two Executive Branch employees set out a putative class action, brought pursuant to the Administrative Procedure Act and other laws, alleging that the Office of Personnel Management violated the E-Government Act of 2002 by failing to conduct a privacy impact assessment for an unknown email server or system for which Executive Branch employees has been provided.
They allege that they were told to trust emails sent from a particular email address (HR@opm.gov). For example, the complaint alleges that the Acting Secretary of Homeland Security sent the following message to all DHS employees: “The Office of Personnel Management (OPM) is testing a new capability allowing it to send important communications to ALL Federal employees from a single email address, HR@opm.gov. If you ever receive communications from this address, it can be considered trusted.” One of the Doe plaintiffs responded to the “test” email, the other did not.
Outside creation and compilation. However, they allege that they have reason to believe that the server used to send that email was created based on requests sent to all agencies seeking information on government employees and that the information was compiled by someone who is not an OPM employee, but instead works for xAI—a corporation for which Elon Musk is the CEO. They also allege that they have reason to believe that the email was made to look as though it came from OPM because, according to a purported federal employee posting on Reddit, someone walked into the OPM building and plugged the email server into the network to send the test messages.
Not secure. The employees allege that, upon information and belief, the server and/or other systems linked to it are retaining information about federal employees in the Executive Branch and that they are not sending emails securely.
The lawsuit presents a cause of action under the E-Government Act of 2002 for failure to complete the required Privacy Impact Assessment before initiating the information collection and seeks injunctive relief.
The lawsuit was filed in the District of Columbia; the case is No. 1:25-cv-00234.
News: LitigationNewsTrends PublicEmployees Privacy ComputerFraudPrivacy