How a (Thus Far Unsuccessful) Lawsuit Caused Elon Musk’s OPM Email to Faceplant

Chris Geidner did a post over the weekend explaining the importance of being litigious. He described how just forcing the Administration to defend itself, on the record and in public, can lead to wins down the road.

The reality of litigation challenging the Trump administration is that it isn’t all going to win.

That’s OK.

Forcing the administration to defend its actions, on the record and in public, is important.

The mere fact of litigating can change implementation of policy to improve its application to those affected. Even a loss can advance awareness about oppressive steps being taken by the administration. And, multiple strategies might be taken to challenge certain actions, some of which will be more successful than others.

From a litigation perspective, in other words, not suing is sometimes “obeying in advance.” Actions need to be challenged. If a key aspect of what President Donald Trump, Elon Musk, and others are doing right now is seeing what they can get away with — and what they can convince people that they can do — then a key part of pushing back against that needs to be challenging everything that can be challenged.

In short: Force them to work for it.

OPM’s cave-in-process on Elon Musk’s respond-or-resign email is a very good example.

Multiple agencies are now instructing employees that, contrary to what Elon said (and Trump appeared to reiterate in presser), responding is optional.

The reason why they’re doing so is virtually certainly due to this lawsuit, filed by Kel McClanahan (here’s his website, if you want to support his work). Its theory was a bit different than a lot of other lawsuits: he argued that OPM was violating its own standards under the E-Government Act mandating the existence and substance of a Privacy Impact Assessment before collecting new information.

46. OPM is an agency subject to the E-Government Act because it is an “establishment in the executive branch of the Government.” 47. A PIA for a “new collection of information” must be “commensurate with the size of the information system being assessed, the sensitivity of information that is in an identifiable form in that system, and the risk of harm from unauthorized release of that information.” The PIA must specifically address “(I) what information is to be collected; (II) why the information is being collected; (III) the intended use of the agency of the information; (IV) with whom the information will be shared; (V) what notice or opportunities for consent would be provided to individuals regarding what information is collected and how that information is shared; [and] (VI) how the information will be secured.”

48. The Office of Management and Budget (“OMB”) is charged with “oversee[ing] the implementation of the privacy impact assessment processing throughout the Government” and “develop[ing] policies and guidelines or agencies on the conduct of privacy impact assessments.”

49. Accordingly, OMB has clarified the minimum requirements for a PIA and the role of PIAs in an agency’s decision to collect (or to refrain from collecting) personal data.

50. According to OMB, “Agencies shall conduct and draft a PIA with sufficient clarity and specificity to demonstrate that the agency fully considered privacy and incorporated appropriate privacy protections from the earliest stages of the agency activity and throughout the information life cycle.”

After he first filed the lawsuit on January 27, OPM did a (legally insufficient, McClanahan argues) Privacy Impact Assessment.

Although the E-Government Act expressly exempts the email system at issue here, which includes only federal government employees, OPM nevertheless has now prepared a PIA. See Attachment A (executed February 5, 2025). That is the sole relief sought through this litigation, and the sole source of Plaintiffs’ asserted irreparable harm. Because the agency has in fact published a PIA (despite it not being required to do so), this case is moot, and Plaintiffs cannot establish irreparable harm.

That PIA gets around providing advance notice about the email because — it claims — responding to any email is voluntary (Josh Marshall may have been the first to notice this, but I don’t think he realizes this PIA exists solely because of the lawsuit).

4.1, How does the project provide individuals notice prior to the collection of information? If notice is not provided, explain why not.

The names and government email addresses of federal government employees are already housed in OPM systems or provided by employing agencies and, in any event, do not contain substantive information about employees. As a result, there is no reason to provide advance notice for the collection of Employee Contact Data. All individuals are provided advance notice of the Employee Response Data, as it is voluntarily provided by the individuals themselves in response to an email.

4.2, What opportunities are available for individuals to consent to uses, decline to provide information, or opt out of the project?

The Employee Response Data is explicitly voluntary, The individual federal government employees can opt out simply by not responding to the email.

Based on those representations — that OPM has a PIA — as well as questions about standing, Judge Randolph Moss denied a Temporary Restraining Order in the lawsuit.

Mind you, the fact that agencies are only now, ten hours before the purported reply deadline, instructing employees not to respond, as well as the fact that DOJ initially instructed DOJ employees to respond (until it reversed course for confidentiality reasons), may help McClanahan prove standing. Imagine employees who did respond before agencies reversed course? Imagine employees who responded to Trump’s public backing for the email? There’s no reversing their injury, or the good faith belief many federal employees would have had that Trump’s comments could be trusted?

Furthermore, OPM claims that actual government employees have fewer privacy protections than others. The lawsuit already includes five plaintiffs who are not government employees. But the Office of US Courts employees also received this email, a violation of separation of powers.

In the course of one month, then, this lawsuit created a way to undercut Musk’s latest assault on government.

Update: In a new filing, McClanahan reveals he’s seeking sanctions.

On 23 February, Plaintiffs’ undersigned counsel served counsel for Defendant Office of Personnel Management (“OPM”) with a motion for sanctions pursuant to Federal Rule of Civil Procedure 11 (“Rule 11”). In the spirit of that rule, Plaintiffs will not elaborate on the content of that motion at this time, other than to say that the allegations are new and relate primarily to OPM’s presentation to the Court of the Privacy Impact Assessment (“PIA”) for the GovernmentWide Email System (“GWES”), which, in light of rapidly unfolding events over the weekend, materially misrepresented the allegedly “voluntary” nature of responses to emails sent using that system,1 coupled with the newly discovered evidence that, as Plaintiffs’ undersigned counsel warned the Court in the 14 February hearing, OPM did not purge the GWES of information about non-Executive Branch employees, but only installed “filters” to keep the emails about the deferred resignation program from being sent to them.

Simply put, OPM sent an email using [email protected] demanding that all employees reply to the email with a list of things they did last week by 11:59 PM on 24 February, and today President Trump stated that if someone does not reply “[they’re] sort of semi-fired or [they’re] fired.” Elon Musk (@elonmusk), X.com (Feb. 24, 2025 1:25 PM), at https://x.com/elonmusk/status/1894091228054261781 (last accessed Feb. 24, 2025).

Update: At about 5:00 (so too late for anything but CYA), HHS sent out guidance on how to respond to the OPM email. It ends with this warning.

Assume that what you write will be read by malign foreign actors and tailor your response accordingly.

Update: OPM told everyone, just hours before end of work today, that responding is voluntary.

In an email to its workforce on Monday, the Justice Department said that during a meeting with the interagency Chief Human Capital Officers Council, OPM informed agencies that employee responses to the email are voluntary. OPM also clarified that despite what Musk had posted, a non-response to the email does not equate to a resignation, the email said.

Update: Before he likely oversaw that email warning about malign foreign actors, HHS’ Acting General Counsel raised a bunch of other reasons this email was problematic.

One message on Sunday morning from the Department of Health and Human Services, led by Robert F. Kennedy Jr., instructed its roughly 80,000 employees to comply. That was shortly after the acting general counsel, Sean Keveney, had instructed some not to. And by Sunday evening, agency leadership issued new instructions that employees should “pause activities” related to the request until noon on Monday.

“I’ll be candid with you. Having put in over 70 hours of work last week advancing Administration’s priorities, I was personally insulted to receive the below email,” Keveney said in an email viewed by the AP that acknowledged a broad sense of “uncertainty and stress” within the agency.

Keveney laid out security concerns and pointed out some of the work done by the agency’s employees may be protected by attorney-client privilege.

Update: Just hours before the deadline, OPM issued new guidance. Using the word “should,” it says people should respond to their managers and CC OPM.

It also excuses Executive Office of the President — purportedly because of the Presidential Records Act.