Federal Judge Declines to Shut Down OPM Email Server

The U.S. District Court for the District of Columbia on March 22, 2023. Richard Moore/The Epoch Times

WASHINGTON—A federal judge in Washington declined to issue a temporary restraining order against the Office of Personnel Management (OPM) over its use of new, government-wide email servers.

The ruling, given at a hearing on Feb. 6, was made after two anonymous government employees, Jane Doe 1 and 2, filed a class action suit against OPM over the use of the outside servers, which they alleged were insecure.

The suit alleged that OPM violated the E-Government Act of 2002 because it did not conduct or submit a privacy impact assessment (PIA) before implementing the servers.

Employees first took note of the new system after receiving two test emails, preceded by a memo stating that they were legitimate, and not a phishing scam.

The plaintiffs sought an injunction “prohibiting OPM from collecting or storing any information about employees of the U.S. Executive Branch in this unknown email server or any linked systems until it has conducted the necessary PIAs.”

However, before the hearing took place, OPM submitted the PIA on Feb. 5, and the motion for a temporary restraining order was denied as “moot,” or irrelevant.

OPM prefaced the assessment by saying it was not legally required in this case.

The PIA cites previous OPM guidance that says a privacy assessment is not needed for “government-run websites, IT systems or collections of information to the extent that they do not collect or maintain information in identifiable form about members of the general public.”

During the hearing, D.C. District Court Judge Randolph Daniel Moss gave early indications that he would deny the request to shut down the servers, as the complaint was based on a situation that had already been remedied.

“The relief that you sought is that I order them to [issue the PIA], and they’ve now done it,” he said.

Attorneys for the plaintiff shifted their argument, saying that although the PIA had been issued, it did not meet proper standards.

Judge Moss rejected this challenge as well since it was not included in the original motion. He also appeared skeptical of the claim, saying that the requirements for a PIA are “relatively minimal.”

An attorney for the plaintiff again requested the restraining order on the grounds of urgency.

“Every day that server stays up it’s more likely to be hacked,” he said.

However, the judge dismissed this claim as “purely speculative.”

He invited the plaintiffs to file a new motion, which they agreed to do by close of business on Feb. 7.

The defense will have until Feb. 11 to respond, and the next hearing is set for Feb. 14 at 11 a.m.