IN RE: U.S. OFFICE OF PERSONNEL MANAGEMENT DATA SECURITY BREACH LITIGATION
No. 17-5217
United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT
Argued November 2, 2018 Decided June 21, 2019
AMERICAN FEDERATION OF GOVERNMENT EMPLOYEES, AFL-CIO, ET AL., APPELLEES NATIONAL TREASURY EMPLOYEES UNION, ET AL., APPELLANTS V. OFFICE OF PERSONNEL MANAGEMENT, ET AL., APPELLEES Consolidated with 17-5232 Appeals from the United States District Court for the District of Columbia (No. 1:15-mc-01394)
Peter A. Patterson argued the cause for Arnold Plaintiffs-Appellants in No. 17-5232. With him on the briefs were David H. Thompson, Daniel C. Girard, Jordan Elias, Tina Wolfson, Gary E. Mason, and Richard B. Rosenthal.
Paras N. Shah argued the cause for appellants National Treasury Employees Union, et al. in No. 17-5217. With him on the briefs were Gregory O‘Duden, Larry J. Adkins, and Allison C. Giles.
Marc Rotenberg and Alan Butler were on the brief for amici curiae Electronic Privacy Information Center (EPIC) and Forty-Four Legal Scholars and Technical Experts in support of appellants.
Sonia M. Carson, Attorney, U.S. Department of Justice, argued the cause for federal appellees. With her on the brief was Mark B. Stern.
Jason J. Mendro argued the cause for appellee KeyPoint Government Solutions, Inc. With him on the brief were F. Joseph Warin, Matthew S. Rozen, and Jeremy M. Christiansen.
Alan Charles Raul, Kwaku A. Akowuah, Daniel J. Hay, and Steven P. Lehotsky were on the brief for amicus curiae The Chamber of Commerce of the United States of America in support of appellees.
Before: TATEL and MILLETT, Circuit Judges, and WILLIAMS, Senior Circuit Judge.
Opinion for the Court filed PER CURIAM.
Opinion concurring in part and dissenting in part filed by Senior Circuit Judge WILLIAMS.
birth dates, Social Security numbers, addresses, and even fingerprint records—of a staggering number of past, present, and prospective government workers. All told, the data breaches affected more than twenty-one million people. Unsurprisingly, given the scale of the attacks and the sensitive nature of the information stolen, news of the breaches generated not only widespread alarm, but also several lawsuits. These suits were ultimately consolidated into two complaints: one filed by the National Treasury Employees Union and three of its members, and another filed by the American Federation of Government Employees on behalf of several individual plaintiffs and a putative class of others similarly
I
As its name suggests, the U.S. Office of Personnel Management serves as the federal government‘s chief human resources agency. In that capacity, OPM maintains electronic personnel files that contain, among other information, copies of federal employees’ birth certificates, military service records, and job applications identifying Social Security numbers and birth dates.
stores electronically in a “Central Verification System.” Consolidated Amended Complaint, In re United States Office of Pers. Mgmt. Data Security Breach Litig., No. 1:15-mc-01394, ¶ 65 (D.D.C. March 14, 2016) (“Arnold Plaintiffs’ Compl.“), J.A. 61. The investigation-related information stored by OPM includes birth dates, Social Security numbers, residency details, passport information, fingerprints, and other records pertaining to employees’ criminal histories, psychological and emotional health, and finances. In recent years, OPM has relied on a private investigation and security firm, KeyPoint Government Solutions, Inc. (“KeyPoint“), to conduct the lion‘s share of the agency‘s background and security clearance investigation fieldwork. KeyPoint investigators have access to the information stored in OPM‘s Central Verification System and can transmit data to and from the agency‘s network through an electronic portal.
It turns out that authorized KeyPoint investigators have not been the only third parties to access OPM‘s data systems. Cyberattackers hacked into the agency‘s network on several occasions between November 2013 and November 2014. Undetected for months, at least two of these breaches resulted in the theft of vast quantities of personal information. According to the complaint, after breaching OPM‘s network “using stolen KeyPoint credentials” around May 2014, Arnold Plaintiffs’ Compl. ¶ 127, J.A. 73, the cyberintruders extracted almost 21.5 million background investigation records from the agency‘s Central Verification System. They gained access to another OPM system near the end of 2014, stealing over four million federal employees’ personnel files. Among the types of information compromised were current and prospective employees’ Social Security numbers, birth dates, and residency details, along with approximately 5.6 million sets of fingerprints. The breaches also exposed the Social Security numbers and birth dates of the spouses and cohabitants of those
who, in order to obtain a security clearance, completed a Standard Form 86. According to the complaints, since these 2014 breaches, individuals whose information was stolen have experienced incidents of financial fraud and identity theft; many others whose information has not been misused—at least, not yet—remain concerned about the ongoing risk that they, too, will become victims of financial fraud and identity theft in the future.
After announcing the breaches in the summer of 2015, OPM initially offered individuals whose information had been compromised fraud monitoring and identity theft protection services and insurance at no cost for either eighteen months or three years, depending on whether their Social Security numbers had been exposed. But OPM‘s offer failed to address the concerns of all such parties, and the agency soon found itself named as a defendant in breach-related lawsuits across the country. The Judicial Panel on Multidistrict Litigation transferred these actions to the U.S. District Court for the District of Columbia for coordinated pretrial proceedings. The suits were ultimately consolidated into two complaints: one brought by the American Federation of Government Employees on behalf of thirty-eight individuals affected by the breaches and a putative class of similarly situated breach victims (“Arnold Plaintiffs“) and another for declaratory and injunctive relief brought by the National Treasury Employees Union (“NTEU“) and three of its members
Arnold Plaintiffs allege that KeyPoint‘s “information security defenses did not conform to recognized industry standards” and that the company unreasonably failed to protect the security credentials that the hackers used to unlawfully access one of OPM‘s systems in mid-2014. Arnold Plaintiffs’ Compl. ¶ 222, J.A. 98. Specifically, they assert that “KeyPoint knew or should have known that its information security defenses did not reasonably or effectively protect Plaintiffs’ and Class members’ [personal information] and the credentials used to access it on KeyPoint‘s and OPM‘s systems.” Id. As for OPM, Arnold Plaintiffs allege that the agency had long been on notice that its systems were prime targets for cyberattackers. OPM experienced data breaches related to cyberattacks in 2009 and 2012, and it is no secret that its network is regularly subject to a strikingly large number of hacking attempts. Despite this, say Arnold Plaintiffs, OPM repeatedly failed to comply with the Federal Information Security Management Act of 2002,
As early as 2007, Information Security Act compliance audits conducted by OPM‘s Office of the Inspector General regularly identified major information security deficiencies that left the agency‘s network vulnerable to attack. Such problems included “severely outdated” security policies and procedures, understaffed and undertrained cybersecurity personnel, and a lack of a centralized information security management structure. Arnold Plaintiffs’ Compl. ¶¶ 92-95,
J.A. 67-68. As a result, in every year from 2007 through 2013, the Inspector General identified “serious concerns that * * * pose an immediate risk to the security of assets or operations“—termed “material weaknesses“—in the agency‘s information security governance program. Id. ¶¶ 87-88, J.A. 66; see also id. ¶¶ 90-97, J.A. 66-68 (listing those weaknesses). Although in 2014 the Inspector General, acting on the basis of “imminently planned improvements,” id. ¶ 98, J.A. 68, reclassified OPM‘s security governance program as a “significant deficiency” (an improvement over the more serious “material weakness“), other serious issues resurfaced at that time. Specifically, in 2014, the agency failed to complete an Information Security Act-required Security Assessment and Authorization for eleven of the twenty-one OPM systems due for reauthorization. Because the agency was unable to ensure the functionality of security controls for the systems that lacked a valid authorization—one of which was “a general system that supported and provided the electronic platform for approximately two-thirds of all information systems operated by OPM“—the Inspector General advised the agency to shut them down. Id. ¶¶ 102-103, J.A. 69-70. Despite the Inspector General‘s recommendation, OPM continued to operate the systems. The agency compounded existing security vulnerabilities by failing to encrypt sensitive data—including Social Security numbers—and
The 2014 cyberattacks were “sophisticated, malicious, and carried out to obtain sensitive information for improper use.” Arnold Plaintiffs’ Compl. ¶¶ 128, 132, J.A. 73-74. Arnold Plaintiffs assert that as a result of these attacks, they have
suffered from a variety of harms, including the improper use of their Social Security numbers, unauthorized charges to existing credit card and bank accounts, fraudulent openings of new credit card and other financial accounts, and the filing of fraudulent tax returns in their names. At least three named Arnold Plaintiffs purchased credit monitoring services after falling victim to such fraud; others have spent time and money attempting to unwind fraudulent transactions made in their names. And some Arnold Plaintiffs who have yet to experience a fraud incident purchased credit monitoring services and spent extra time monitoring their accounts to mitigate the “increased risk” of identity theft caused by the breaches. Id. ¶ 163, J.A. 81-83.
Arnold Plaintiffs assert several claims against OPM, but they press only one on appeal: that the agency “willfully failed” to establish appropriate safeguards to ensure the security and confidentiality of their private information, in violation of Section 552a(e)(10) of the Privacy Act of 1974. Arnold Plaintiffs’ Compl. ¶ 182, J.A. 89; see also
free lifetime identity theft and fraud protection services to all putative class members, among other things.
The other complaint, filed by the National Treasury Employees Union, seeks declaratory and injunctive relief against the Acting Director of OPM in her official capacity based on essentially the same set of facts. NTEU Plaintiffs assert that when they provided OPM with the sensitive personal information ultimately exposed in the breaches, they did so upon the agency‘s assurance that it “would be safeguarded” and kept confidential. Amended Complaint for Declaratory and Injunctive Relief, In re United States Office of Pers. Mgmt. Data Security Breach Litig., No. 1:15-mc-01394, ¶ 75 (D.D.C. June 3, 2016) (“NTEU Plaintiffs’ Compl.“), J.A. 179. They allege that OPM‘s “reckless failure to safeguard [NTEU Plaintiffs‘] personal information,” which ultimately “resulted in [its] unauthorized disclosure” during the 2014 attacks, id. at 3, J.A. 155, amounted to a violation of what they describe as their “constitutional right to informational privacy,” id. ¶ 98, J.A. 186.
NTEU Plaintiffs further allege that, despite the fallout from the 2014 breaches,
privacy and an order requiring the agency to provide them with free lifetime credit monitoring and identity theft protection. They also request an injunction requiring OPM “to take immediately all necessary and appropriate steps to correct deficiencies in [its] IT security program so that NTEU members’ personal information will be protected from unauthorized disclosure” in the future. Id. at 35, J.A. 187.
OPM and KeyPoint moved to dismiss Arnold Plaintiffs’ complaint, arguing that they lacked Article III standing, that their claims were barred by sovereign immunity, and that they failed to state valid claims under the state and federal statutes and common-law theories invoked. OPM moved to dismiss NTEU Plaintiffs’ complaint for lack of standing and failure to state a claim upon which relief could be granted—that is, failure to allege a cognizable constitutional violation. The district court granted both motions to dismiss on the ground that neither Arnold Plaintiffs nor NTEU Plaintiffs pled sufficient facts to demonstrate Article III standing. Rejecting plaintiffs’ argument that they faced a heightened risk of identity theft due to the breaches, the court held that the facts alleged failed to plausibly support the conclusion that this risk of future injury was either substantial or clearly impending. The district court ultimately concluded that only those plaintiffs who specifically identified out-of-pocket losses stemming from the actual misuse of their data had suffered an injury in fact sufficient for standing purposes. But even those plaintiffs lacked standing, the district court concluded, because they failed to allege facts demonstrating that the misuse of their information was traceable to the OPM breaches in particular.
The district court went on to explain that it also lacked subject matter jurisdiction over Arnold Plaintiffs’ claims for the additional reasons that (i) they failed to plead the actual damages necessary to bring them within the Privacy Act‘s
waiver of sovereign immunity; and (ii) as a government contractor, KeyPoint enjoyed derivative sovereign immunity from suit. Finally, the court concluded that Arnold Plaintiffs failed to plausibly allege a Privacy Act claim and that NTEU Plaintiffs’ complaint failed to state a constitutional claim. Both sets of plaintiffs have appealed.
We reverse in part and affirm in part the district court‘s judgment. We hold that both sets of plaintiffs have alleged facts sufficient to satisfy Article III standing requirements. Arnold Plaintiffs have stated a claim for damages under the Privacy Act, and have unlocked OPM‘s waiver of sovereign immunity, by alleging OPM‘s knowing refusal to establish appropriate information security safeguards. KeyPoint is not entitled to derivative sovereign immunity because it has not shown that its alleged security faults were directed by the government, and it is alleged to have violated the Privacy Act standards incorporated into its contract with OPM. Finally,
II
“[T]he irreducible constitutional minimum of standing consists of three elements.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016) (internal quotation marks omitted). First, plaintiffs must demonstrate that they suffered an injury in fact that is “concrete and particularized and actual or imminent, not conjectural or hypothetical.” Id. at 1548 (internal quotation marks omitted). “An allegation of future injury” passes Article III muster only if it “is ‘certainly impending,’ or there is a ‘substantial risk’ that the harm will occur.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (quoting Clapper v. Amnesty Int‘l USA, 568 U.S. 398, 414 & n.5 (2013)). Second, plaintiffs must demonstrate causation; that is, they must show
that their claimed injury is “fairly traceable to the challenged conduct of the defendant.” Spokeo, 136 S. Ct. at 1547. “Article III standing does not require that the defendant be the most immediate cause, or even a proximate cause, of the plaintiffs’ injuries; it requires only that those injuries be ‘fairly traceable’ to the defendant.” Attias v. Carefirst, Inc., 865 F.3d 620, 629 (D.C. Cir. 2017), cert. denied, 138 S. Ct. 981 (2018). And third, plaintiffs must demonstrate that “it is likely, as opposed to merely speculative, that the[ir] injury will be redressed by a favorable decision.” Friends of the Earth, Inc. v. Laidlaw Environmental Servs. (TOC), Inc., 528 U.S. 167, 181 (2000).
Where, as here, defendants challenge standing at the pleading stage without disputing the facts alleged in the complaint, “we accept the well-pleaded factual allegations as true and draw all reasonable inferences from those allegations in the plaintiff‘s favor,” but we do not assume the truth of legal conclusions or accept inferences that are unsupported by the facts alleged in the complaint. Arpaio v. Obama, 797 F.3d 11, 19 (D.C. Cir. 2015). “We review de novo the district court‘s dismissal for lack of standing.” Id. The question at this early juncture in the litigation is whether plaintiffs have plausibly alleged standing. Contrary to the district court‘s ruling, plaintiffs need not yet establish each element of standing by a preponderance of the evidence. See Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992) (“[E]ach element [of standing] must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the litigation.“).
A
We begin with NTEU Plaintiffs. For standing purposes, we assume that NTEU Plaintiffs have, as they claim, a “constitutional right to informational privacy” that was
violated “the moment that [cyberattackers stole] their inherently personal information * * * from OPM‘s deficiently secured databases.” NTEU Br. 11; see also Estate of Boyland v. Department of Agric., 913 F.3d 117, 123 (D.C. Cir. 2019) (“[W]hen considering whether a plaintiff has Article III standing, a federal court must assume, arguendo, the merits of his or her legal claim.“) (internal quotation marks omitted). Furthermore, given NTEU Plaintiffs’ allegations regarding OPM‘s continued failure to adequately secure its databases, it is reasonable to infer
B
Arnold Plaintiffs allege no such constitutional injury, but they do claim to have suffered a variety of past and future data-breach related harms. See, e.g., Arnold Plaintiffs’ Compl. ¶ 22,
J.A. 44-45 (alleging that Plaintiff Jane Doe has “suffer[ed] stress resulting from concerns for her personal safety and that of her family members” since being informed by the FBI that her personal information “had been acquired by the so-called Islamic State of Iraq and al-Sham (‘ISIS‘)“). For purposes of our standing analysis, we focus on one injury they all share: the risk of future identity theft. As we have already recognized, “identity theft * * * constitute[s] a concrete and particularized injury.” Attias, 865 F.3d at 627; see also Hancock v. Urban Outfitters, Inc., 830 F.3d 511, 514 (D.C. Cir. 2016) (offering the “increased risk of fraud or identity theft” as an “example” of a “concrete consequence” for standing purposes). Yet, the district court concluded that Arnold Plaintiffs’ complaint provided an insufficient basis from which to infer that, in the wake of the OPM breaches, Arnold Plaintiffs faced any meaningful risk of future identity theft, much less a “substantial” one. In re United States Office of Pers. Mgmt. Data Security Breach Litig. (”In re OPM“), 266 F. Supp. 3d 1, 35 (D.D.C. 2017). Furthermore, finding that “the risk of identity theft was neither clearly impending nor substantial,” the district court concluded that any expenses that Arnold Plaintiffs incurred attempting to mitigate that risk likewise failed to qualify as an Article III injury in fact. Id. at 36; see also Clapper, 568 U.S. at 416 (“[R]espondents cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.“).
Arnold Plaintiffs argue that the district court‘s conclusion is incompatible with our decision in Attias v. CareFirst. In that case, we determined that the victims of a cyberattack on CareFirst, a health insurance company, “cleared the low bar to establish their standing at the pleading stage” by plausibly alleging that they faced a substantial risk of identity theft as a result of the company‘s negligent failure to thwart the attack.
Attias, 865 F.3d at 622. Specifically, the complaint alleged that the breach exposed “all of the information wrongdoers need for appropriation of a victim‘s identity“: personal identification information, credit card numbers, and Social Security numbers. Id. at 628 (internal quotation marks omitted). Based largely
Although the OPM cyberattacks differ in several respects from the breach at issue in Attias, there is no question that the OPM hackers, too, now have in their possession all the information needed to steal Arnold Plaintiffs’ identities. Arnold Plaintiffs have alleged that the hackers stole Social Security numbers, birth dates, fingerprints, and addresses, among other sensitive personal information. It hardly takes a criminal mastermind to imagine how such information could be used to commit identity theft. Indeed, several Arnold Plaintiffs claim that they have already experienced various types of identity theft, including the unauthorized opening of new credit card and other financial accounts and the filing of fraudulent tax returns in their names. Moreover, unlike existing credit card numbers, which, if compromised, can be changed to prevent future fraud, Social Security numbers and
addresses cannot so readily be swapped out for new ones. And, of course, our birth dates and fingerprints are with us forever. Viewing the allegations in the light most favorable to Arnold Plaintiffs, as we must, we conclude that not only do the incidents of identity theft that have already occurred illustrate the nefarious uses to which the stolen information may be put, but they also support the inference that Arnold Plaintiffs face a substantial—as opposed to a merely speculative or theoretical—risk of future identity theft.
It is worth noting that several Arnold Plaintiffs also allege that unauthorized charges have appeared on their existing credit card and bank account statements since the breaches. According to OPM, because none of these Arnold Plaintiffs “specifically alleged the OPM incidents affected their existing account information,” the reported incidents of fraud on existing accounts (and, presumably, the risk of future fraud on those accounts) cannot plausibly be attributed to the OPM breaches. Gov‘t Br. 21. But we need not travel down that road because, regardless of whether the hackers obtained all the information necessary to make unauthorized charges to existing accounts, it is undisputed that the other forms of fraud alleged—the opening of new accounts and the filing of fraudulent tax returns—may be accomplished using the information stolen during the breaches at issue.
OPM argues that Arnold Plaintiffs’ allegations of “scattered instances of widely varying fraud” are insufficient to support a plausible inference that Arnold Plaintiffs face an ongoing, substantial risk of identity theft. Gov‘t Br. 20. Specifically, OPM contends that despite the sensitive nature of the information stolen in the attacks, “[i]t is impossible under these circumstances to ‘easily construct any kind of colorable theory’ that a desire to commit fraud motivated” the OPM breaches. Id. at 21 (quoting In re OPM, 266 F. Supp. 3d at 38).
This is especially the case, OPM argues, because “this is not just a data breach,” but rather
As an initial matter, the district court should not have relied even in part on its own surmise that the Chinese government perpetrated these attacks. Absent any factual allegations regarding the identity of the cyberattackers, the district court was not free to conduct its own extra-record research and then draw inferences from that research in OPM‘s and KeyPoint‘s favor. See Arpaio, 797 F.3d at 19 (explaining that where the defendant challenges the plaintiff‘s standing at the motion-to-dismiss stage, we “draw all reasonable inferences * * * in the plaintiff‘s favor“). Beyond that, although a cyberattack on a government system might well be motivated by a purpose other than identity theft, given the type of information stolen in the OPM breaches and Arnold Plaintiffs’ allegations regarding the subsequent misuse of that information, it is just as plausible to infer that identity theft is
at least one of the hackers’ goals, even if those hackers are indeed affiliated with a foreign government.
Our dissenting colleague takes a different tack, suggesting that because this case involves government databases, “espionage * * * is * * * an ‘obvious alternative explanation‘” for the attacks. See Dissenting Op. at 4 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 682 (2009)). We disagree as to just how obvious an explanation this is based on the facts alleged in the complaint. Furthermore, given that espionage and identity theft are not mutually exclusive, the likely existence of an espionage-related motive hardly renders implausible Arnold Plaintiffs’ claim that they face a substantial future risk of identity theft and financial fraud as a result of the breaches. See, e.g., Watson Carpet & Floor Covering, Inc. v. Mohawk Indus., Inc., 648 F.3d 452, 458 (6th Cir. 2011) (“Ferreting out the most likely reason for the defendants’ actions is not appropriate at the pleadings stage * * * [T]he plausibility of [one particular] reason for the refusals to sell carpet does not render all other reasons implausible.“). By contrast, in the cases cited by the dissent, the obvious alternative explanations were necessarily incompatible with the plaintiffs’ versions of events. See Iqbal, 556 U.S. at 682 (rejecting claims of invidious discrimination as implausible where there existed an obvious, nondiscriminatory law enforcement justification for the challenged acts); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 567-568 (2007) (rejecting a conspiracy claim as implausible where history and market forces provided “a natural explanation” for the defendants’ behavior).
markedly less important where, as here, several victims allege that they have already suffered identity theft and fraud as a result of the breaches. When considered in combination with the obvious potential for fraud presented by the information stolen during the breaches, the fact that certain Arnold Plaintiffs have already had fraudulent accounts opened and tax returns filed in their names moves the risk of future identity theft across the line from speculative to substantial, at least at this early stage in the proceedings. See id. at 625 (explaining that at the pleading stage, “plaintiffs are required only to state a plausible claim that each of the standing elements is present“) (internal quotation marks omitted).
The circumstances here differ markedly from those in the two cases OPM cites in support of its argument that Arnold Plaintiffs’ risk of future identity theft is merely conjectural. In Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017), a laptop containing patients’ unencrypted personal information, “including names, birth dates, the last four digits of social security numbers, and physical descriptors,” and four boxes of medical records that contained names and Social Security numbers went missing from a Veterans Affairs medical center. Id. at 267-269. The Fourth Circuit held that the risk of future identity theft stemming from the incidents was too speculative to satisfy the injury-in-fact requirement because the plaintiffs failed to allege either (i) that the thief “intentionally targeted” the personal information contained in the laptop and boxes or (ii) that the thief subsequently used that information to commit identity theft. Id. at 274-275 (“[E]ven after extensive discovery, the * * * plaintiffs [who sued over the theft of the laptop] have uncovered no evidence that the information contained on the stolen laptop has been accessed or misused or that they have suffered identity theft, nor, for that matter, that the thief stole the laptop with the intent to steal their private information.“); id. at 275 (“Watson‘s complaint suffers from
the same deficiency with regard to the four missing boxes of pathology reports.“). Without such allegations, the Fourth Circuit explained, there was nothing to “push the threatened injury of future identity theft beyond the speculative to the sufficiently imminent.” Id. at 274.
In the other case, Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011), an unknown hacker infiltrated a payroll processing firm‘s database, “potentially” gaining access to employees’ “personal and financial information.” Id. at 40. It was “not known whether the hacker read, copied, or understood the data,” id., and none of the affected parties alleged that their data had since been misused, id. at 44 (“Appellants have alleged no misuse.“). Because the plaintiffs’ claimed risk of future identity theft therefore rested solely on “hypothetical speculations concerning the possibility of future injury,” the Third Circuit held that the risk was insufficient to support standing. Id. at 43.
Here, in contrast to those two cases, Arnold Plaintiffs both allege that the OPM cyberattackers intentionally targeted their information and point out the subsequent misuse of that information. See Arnold Plaintiffs’ Compl. ¶¶ 128, 130, J.A. 73-74 (alleging that the hackers targeted—and extracted data from—the agency‘s “Electronic Official Personnel Folder system” and the database used to collect background check information); see, e.g., id. ¶¶ 21-22, 24, 26, J.A. 44-48 (alleging incidents
identifiable taking occurred; all that is known is that a firewall was penetrated.“).
Although it is true, as a general principle, that ““as * * * breaches fade further into the past, * * * threatened injuries become more and more speculative,” we are unpersuaded by the dissent‘s suggestion that the passage of less than two years between these particular attacks and Arnold Plaintiffs’ filing of the operative complaint is enough to render the threat of future harm insubstantial. Dissenting Op. at 7 (quoting Beck, 848 F.3d at 275). The plaintiffs in Beck suffered no misuse of their data prior to filing their complaint. See supra at 19-20. And the same was true of the plaintiffs in Chambliss v. Carefirst, Inc., 189 F. Supp. 3d 564 (D. Md. 2016), the case cited by the dissent and the court in Beck for the proposition that the threat of future injury diminishes over time. See id. at 570 (noting that plaintiffs had not experienced “any misuse” of their data prior to filing their complaint). Although the passage of two years in a run-of-the-mill data breach case might, absent allegations of subsequent data misuse, suggest that a claim of future injury is less than plausible, that is not the situation we face here. Conducted over several months by sophisticated and apparently quite patient cyberhackers, the attacks at issue in this case affected over twenty-one million people and involved information far more sensitive than credit card numbers. Cyberhacking on such a massive scale is a relatively new phenomenon, and we are unwilling at this stage to assume that the passage of a year or two without any clearly identifiable pattern of identity theft or financial fraud means that all those whose data was compromised are in the clear.
Drawing all reasonable inferences in Arnold Plaintiffs’ favor, we conclude that they have alleged facts sufficient to support their claim of future injury, notwithstanding the passage of time and the governmental character of the databases at issue here. Given the nature of the information stolen and the fact that several named Arnold Plaintiffs have already experienced some form of identity theft since the breaches, it is at least plausible that Arnold Plaintiffs run a substantial risk of falling victim to other such incidents in the future. See Hutton v. National Bd. of Examiners in Optometry, Inc., 892 F.3d 613, 621-622 (4th Cir. 2018) (finding a substantial risk of identity theft where the plaintiffs alleged not only that their information had been stolen by hackers, but also that it was subsequently “used in a fraudulent manner“). Because Arnold Plaintiffs adequately allege a substantial risk of future identity theft, any expenses they have reasonably incurred to mitigate that risk likewise qualify as injury in fact. See id. at 622 (“[T]he [Supreme] Court has recognized standing to sue on the basis of costs incurred to mitigate or avoid harm when a substantial risk of harm actually exists.“) (citing Clapper, 568 U.S. at 414 n.5); see also Hearing Tr. 35 (Oct. 27, 2016) (credit protection services for victims of the breaches announced in June 2015 were not “up and running until September” of that year); Arnold Plaintiffs’ Compl. ¶ 28, J.A. 48-49 (Plaintiff Kelly Flynn purchased credit monitoring in July 2015).
The district court evaluated the second element of
Arnold Plaintiffs have alleged facts supporting a reasonable inference that their claimed data breach-related injuries are fairly traceable to OPM‘s failure to secure its information systems. Not only do Arnold Plaintiffs detail OPM‘s failure to heed repeated warnings by its own Inspector General regarding serious vulnerabilities in the agency‘s systems, but they also allege that as a result of that failure, hackers managed to breach key OPM systems on several different occasions.
With respect to KeyPoint, Arnold Plaintiffs further allege that the company‘s failure to properly secure its login credentials “was a substantial factor in causing the Data Breaches.” Arnold Plaintiffs’ Compl. ¶ 228, J.A. 99. KeyPoint contends that Arnold Plaintiffs’ complaint fails to trace the breaches to any actual misconduct by KeyPoint, but that argument lacks merit. Arnold Plaintiffs’ complaint alleges not only that the hackers accessed OPM‘s systems “using stolen KeyPoint credentials,” id. ¶ 127, J.A. 73, but also that the company was negligent in “failing to protect and secure its * * * credentials,” id. ¶ 228, J.A. 99, by, among other things, “failing to * * * comply with industry-standard data security practices,” id. ¶ 223(b), J.A. 98. It is reasonable to infer that “data security practices” would cover practices related to securing credentials. It is likewise reasonable to infer, based on the allegations contained in the complaint, that KeyPoint is at least partially to blame for the breaches due to its failure to comply with such practices.
As previously explained, even if the breaches in question did not expose all information necessary to make fraudulent charges on victims’ existing financial accounts, the personal data the hackers did manage to obtain is enough, by itself, to enable several forms of identity theft. That fact, combined with the allegations that at least some of the stolen information was actually misused after the breaches, suffices to support a reasonable inference that Arnold Plaintiffs’ risk of future identity theft is traceable to the OPM cyberattacks. Neither the likelihood that some Arnold Plaintiffs experienced other types of unrelated fraud nor the speculative possibility that they might also have been the victims of other data breaches renders causation implausible here. See In re Zappos.com, Inc., 888 F.3d 1020, 1029 (9th Cir. 2018) (“That hackers might have stolen Plaintiffs’ [personal identifying information] in unrelated breaches, and that Plaintiffs might suffer identity theft or fraud caused by the data stolen in those other breaches * * *, is less about standing and more about the merits of causation and damages.“), cert. denied, 139 S. Ct. 1373 (2019). Nor are we troubled, as OPM suggests we should be, by certain Arnold Plaintiffs’ failure to specify exactly when, in relation to the data breaches, fraudsters first misused their data. The Supreme Court has explained
This brings us, then, to the final element of standing, where, as previously noted, we ask whether “it is likely, as opposed to merely speculative” that Arnold Plaintiffs’ claimed injury “will be redressed by a favorable decision.” Friends of the Earth, 528 U.S. at 181. Although the district court never reached this question, we think Arnold Plaintiffs have easily demonstrated that their substantial risk of future identity theft and related mitigation expenses are redressable.
Granting that it may well be impossible at this point to eliminate the risk of future identity theft stemming from the OPM breaches, the money damages Arnold Plaintiffs seek can redress certain proven injuries related to that risk (such as reasonably-incurred credit monitoring costs). See, e.g., In re Zappos.com, 888 F.3d at 1030 (“The injury from the risk of identity theft is also redressable by relief that could be obtained through this litigation. If Plaintiffs succeed on the merits, any proven injury could be compensated through damages.“) (citation omitted); Attias, 865 F.3d at 629 (“The fact that plaintiffs have reasonably spent money to protect themselves against a substantial risk creates the potential for them to be made whole by monetary damages.“).
In sum, like the Attias plaintiffs, both sets of plaintiffs here have “cleared the low bar to establish their standing at the pleading stage.” Id. at 622. Arnold Plaintiffs have plausibly alleged a substantial risk of future identity theft that is fairly traceable to OPM‘s and KeyPoint‘s cybersecurity failings and likely redressable, at least in part, by damages, and NTEU Plaintiffs have plausibly alleged actual and imminent constitutional injuries that are likewise traceable to OPM‘s challenged conduct and redressable either by a declaration that the agency‘s failure to protect plaintiffs’ personal information is unconstitutional or by an order requiring OPM to correct deficiencies in its cybersecurity program. We therefore have no need to address the other bases for standing asserted by NTEU and Arnold Plaintiffs. See, e.g., id. at 626 n.2 (explaining that when plaintiffs have standing “based on their heightened risk of future identity theft,” it is unnecessary to address their other theories of injury in fact).
Having resolved the standing issue in NTEU and Arnold Plaintiffs’ favor, we turn to another potential jurisdictional stumbling block: sovereign immunity.
III
It is “axiomatic” that a waiver of sovereign immunity is a jurisdictional “prerequisite” for Arnold Plaintiffs’ claims against OPM to get out of the starting gate. United States v. Mitchell, 463 U.S. 206, 212 (1983); accord Federal Deposit Ins. Corp. v. Meyer, 510 U.S. 471, 475 (1994). The
The district court nonetheless ruled that OPM‘s sovereign immunity remained intact, reasoning that Arnold Plaintiffs failed to allege the type of harms covered by the
To unlock the
A
To start, Arnold Plaintiffs have straightforwardly alleged a “willful” violation of the
The complaint alleges in no uncertain terms that OPM dropped that ball because appropriate safeguards were not in place. See, e.g., Arnold Plaintiffs’ Compl. ¶ 134, J.A. 74 (“OPM‘s decisions not to comply with [Information Security Act] requirements for critical security safeguards enabled hackers to access and loot OPM‘s systems for nearly a year without being detected.“); id. ¶ 178, J.A. 87 (“Despite known and persistent threats from cyberattacks, OPM allowed multiple ‘material weaknesses’ in its information security systems to continue unabated. As a result, Plaintiffs’ and Class members’ [government investigation information] under OPM‘s control was exposed, stolen, and misused.“).
Of course, violating the
Instead, a complaint must plausibly allege that the agency‘s security failures were “in flagrant disregard of [their] rights under the Act,” were left in place “without grounds for believing them to be lawful,” or were “so patently egregious and unlawful that anyone undertaking the conduct should have known it unlawful.” Maydak, 630 F.3d at 179; accord 120 Cong. Rec. 40406 (1974) (“Analysis of House and Senate Compromise Amendments to the Federal Privacy Act“) (“On a continuum between negligence and the very high standard of willful, arbitrary, or capricious conduct, this standard is viewed as only somewhat greater than gross negligence.“); see also Beaven, 622 F.3d at 549 (requiring defendants to have “committ[ed] the act without grounds for believing it to be lawful, or flagrantly disregard[ed] others’ rights under the Privacy Act“) (formatting altered); Andrews v. Veterans Admin., 838 F.2d 418, 425 (10th Cir. 1988) (agency “action [must be] so patently egregious and unlawful that anyone undertaking the conduct should have known it unlawful, or conduct committed without grounds for believing it to be lawful or [an] action flagrantly disregarding others’ rights under the Act“) (formatting altered).1
Arnold Plaintiffs’ complaint clears that hurdle by plausibly and with specificity alleging that OPM was willfully indifferent to the risk that acutely sensitive private information was at substantial risk of being hacked. According to the complaint, at the time of the breach, OPM had long known that its electronic record-keeping systems were prime targets for hackers. The agency suffered serious data breaches from hackers in 2009 (millions of users’ personal information stolen) and 2012 (OPM access credentials stolen and posted online), and is subject to at least ten million unauthorized electronic intrusion attempts every month. Arnold Plaintiffs’ Compl. ¶¶ 78-79, J.A. 64.
Despite that pervading threat, OPM effectively left the door to its records unlocked by repeatedly failing to take basic, known, and available steps to secure the trove of sensitive information in its hands. Information Security Act audits by OPM‘s Inspector General repeatedly warned OPM about material deficiencies in its information security systems. Among the identified flaws were
-
severely outdated security policies and procedures; - permitting employees to leave open, or to not terminate, remote access;
- understaffed and undertrained cybersecurity personnel;
- failure to implement or enforce multi-factor identification in any of its major information systems;
- declining to patch or install security updates for its systems promptly;
- lacking a mature vulnerability scanning program to find and track the status of security weaknesses in its systems;
- failure to maintain a centralized information security management structure that would continuously monitor security events and controls;
- lacking the ability to detect unauthorized devices connected to its network; and
- failure to engage in appropriate oversight of its contractor-operated systems.
So forewarned, OPM chose to leave those critical information security deficiencies (and more) in place. On top of that, in the year that the hacks occurred, OPM (allegedly) also left undone mandated security assessments and authorizations for half of its electronic record-keeping systems.
The complaint‘s plausible allegations that OPM decided to continue operating in the face of those repeated and forceful warnings, without implementing even the basic steps needed to minimize the risk of a significant data breach, is precisely the type of willful failure to establish appropriate safeguards that makes out a claim under the
B
Arnold Plaintiffs’ lawsuit is not in the clear yet. The complaint must also allege facts showing that they suffered “actual damages” as “a result of” OPM‘s
1
“Actual damages” within the meaning of the
While those harms certainly qualify as actual damages, the complaint contains still more relevant allegations of injury.
First, nine of the named Arnold Plaintiffs purchased credit protection and/or credit repair services after learning of the breach. Paul Daly, for example, purchased credit monitoring services after a fraudulent 2014 tax return was filed in his name. And Teresa J. McGarry subscribed to a monthly credit and identity protection service to prevent identity theft. Those reasonably incurred out-of-pocket expenses are the paradigmatic example of “actual damages” resulting from the violation of privacy protections. See Cooper, 566 U.S. at 298.2
OPM counters that those individual purchases were unnecessary because Congress provided credit monitoring services for potentially affected individuals. Congress, though, did not offer credit repair services. Anyhow, the argument wrongly assumes facts in OPM‘s favor at the complaint stage, such as that the services offered were equal or superior to those obtained privately, or that they took effect in a timely manner and for a sufficient period of time. See Agnew v. District of Columbia, 920 F.3d 49, 53 (D.C. Cir. 2019) (on a motion to dismiss “we assume the truth of all plaintiffs’ plausibly pleaded allegations, and draw all reasonable inferences in their favor“). Notably, at least one named plaintiff purchased credit monitoring services before OPM‘s offered services were “up and running.” Compare Hearing Tr. 35, with Arnold Plaintiffs’ Compl. ¶ 28, J.A 48-49.
Second, seven of the named Arnold Plaintiffs had accounts opened and purchases made in their names. For example, Kelly Flynn and her husband had several new credit card accounts fraudulently opened in their names. They also discovered that two separate loans totaling $6,400 had been taken out in their names without their permission and were now delinquent. Those financial losses qualify as “actual damages.” See Cooper, 566 U.S. at 298-299.
The district court deemed those damages insufficient because Arnold Plaintiffs did not further allege that their costs went unreimbursed. That was error. At this stage of the litigation, all facts and reasonable inferences must be drawn in favor of Arnold Plaintiffs, and the complaint provides no basis for disregarding the claimed financial losses based on OPM‘s speculation that Arnold Plaintiffs were indemnified. See Hancock v. Urban Outfitters, Inc., 830 F.3d 511, 513-514 (D.C. Cir. 2016).
Anyhow, “an injured person may usually recover in full from a wrongdoer regardless of anything he may get from a collateral source unconnected with the wrongdoer.” Kassman v. American Univ., 546 F.2d 1029, 1034 (D.C. Cir. 1976) (per curiam) (formatting altered); accord Restatement (Second) of Torts § 920A(2). That rule prevents the victim‘s benefits from becoming the tortfeasor‘s windfall. See Hudson v. Lazarus, 217 F.2d 344, 346 (D.C. Cir. 1954). So too here.
Third, Plaintiffs Kelly Flynn and six others had false tax returns filed using their information and have experienced delays in receiving federal and state tax refunds. The delay in those Plaintiffs’ receipt of their refunds, and the forgone time value of that money, is an actual, tangible pecuniary injury.
OPM argues “no harm, no foul” because the Internal Revenue Service must pay taxpayers interest due for delayed refunds. See
Lastly, one Plaintiff, Lillian Gonzalez-Colon, spent more than 100 hours to resolve the fraudulent tax return filing and to close a fraudulently opened account. Those efforts “required her to take time off work[]” to address the consequences of the OPM breach. Arnold Plaintiffs’ Compl. ¶ 31, J.A. 50-51; see Beaven, 622 F.3d at 557-559 (concluding that plaintiffs could claim damages for “lost time” spent “dealing with the disclosure” of their Bureau of Prison personnel files).
OPM urges us to hold Gonzalez-Colon to
For all of those reasons, Arnold Plaintiffs have adequately alleged actual damages within the meaning of the
2
The complaint also explains how Arnold Plaintiffs’ actual damages were the “result of” OPM‘s
The complaint alleges facts demonstrating proximate cause. Arnold Plaintiffs contend that OPM‘s failure to establish appropriate information security safeguards opened the door to the hackers, giving them ready access to a storehouse of personally identifiable and sensitive financial information. In particular, the complaint explains that OPM‘s failure to adopt basic protective measures “foreseeably heightened the risk of a successful intrusion into OPM‘s systems.” Arnold Plaintiffs’ Compl. ¶ 134, J.A. 74. And its decisions to disregard the Inspector General‘s repeated warnings and “not to comply with [Information Security Act] requirements for critical security safeguards enabled hackers to access and loot OPM‘s systems for nearly a year without being detected.” Id.; see id. ¶¶ 105-113, J.A. 70-71.
The proof is in the pudding: Numerous Arnold Plaintiffs suffered forms of identity theft accomplishable only with the type of information that OPM stored and the hackers accessed. That directly links the hack to the theft of the victims’ private information, the pecuniary harms suffered, and the ongoing increased susceptibility to identity theft or financial injury. See Arnold Plaintiffs’ Compl. ¶¶ 14, 17, 21-22, 24-26, 28-29, 31-32, 34, 39-41, 45, 49, J.A. 40-59; Attias v. CareFirst, Inc., 865 F.3d 620, 629 (D.C. Cir. 2017) (plaintiffs plausibly alleged risk of identity theft for
In any event, OPM makes no claim that these particular plaintiffs have been subjected to hacks of equivalent breadth and depth, sweeping in such acutely sensitive personal information as Social Security numbers, fingerprints, and birth certificates.
In sum, Arnold Plaintiffs have adequately alleged (i) that OPM willfully chose not to establish basic and necessary information security safeguards in violation of
IV
In addition to their
OPM tasked KeyPoint with performing background and security clearance investigations and inputting the sensitive information it collected into OPM‘s electronic recordkeeping system. The hackers allegedly were able to obtain KeyPoint credentials and then used them to gain access to OPM‘s network. See Arnold Plaintiffs’ Compl. ¶ 106, J.A. 70.
The district court held that, as OPM‘s contractor, KeyPoint enjoyed “derivative sovereign immunity” from those claims. We review the applicability of derivative sovereign immunity de novo, see Cunningham v. General Dynamics Info. Tech., Inc., 888 F.3d 640, 645 (4th Cir. 2018), cert. denied, 139 S. Ct. 417 (2018), and find no basis for its application in this case. OPM‘s contract obligated KeyPoint to meet the same standards for protecting personal information that the
As a private company, KeyPoint ordinarily would not enjoy immunity against the statutory and tort claims asserted by Arnold Plaintiffs. But government contractors may sometimes “obtain certain immunity in connection with work which they do pursuant to their contractual undertakings with the United States.” Campbell-Ewald Co. v. Gomez, 136 S. Ct. 663, 672 (2016) (internal quotation marks omitted) (quoting Brady v. Roosevelt S.S. Co., 317 U.S. 575, 583 (1943)).
Derivative sovereign immunity, though, is less “embracive” than the
Like the plaintiff in Campbell-Ewald, Arnold Plaintiffs have plausibly alleged that KeyPoint‘s failure to secure its credentials ran afoul of both OPM‘s explicit instructions and federal law standards, rendering derivative sovereign immunity unavailable.
At the outset, KeyPoint‘s failure to place in the record its contract with OPM makes it particularly difficult for it to establish, on a motion to dismiss, that its alleged security lapses were “authorized and directed” by OPM, Campbell-Ewald, 136 S. Ct. at 673 (quoting Yearsley, 309 U.S at 20). See generally Banneker Ventures, LLC v. Graham, 798 F.3d 1119, 1133 (D.C. Cir. 2015).
In fact,
of the Privacy Act to be “applied to such system.”
The complaint expressly asserts that KeyPoint failed to fulfill those obligations, which led to the break-in. KeyPoint allegedly violated its regulatory and contractual obligations, among other things, to (i) “secure its systems for gathering and storing” government investigation information despite “knowing of [its] vulnerabilities;” (ii) “comply with industry-standard data security practices;” (iii) “perform requisite due diligence and supervision in expanding its workforce;” (iv) “encrypt [government investigation information] at collection, at rest, and in transit;” (v) “employ adequate network segmentation and layering;” (vi) “ensure continuous system and event monitoring and recording;” and (vii) “otherwise implement security policies and practices sufficient to protect * * * [government investigation information] from unauthorized disclosure.” Arnold Plaintiffs’ Compl. ¶ 223, J.A. 98. Notably, it was KeyPoint‘s alleged failure to secure and protect its employees’ log-in credentials that allowed the hackers to access OPM‘s system in May 2014, and it was from there that the hackers ultimately stole 21.5 million background investigation records.
* * *
Unsurprisingly, KeyPoint does not argue that OPM “authorized and directed” it to design its system with the security flaws that Arnold Plaintiffs identify. Campbell-Ewald, 136 S. Ct. at 673. So KeyPoint cannot wrap itself in derivative immunity garb on the ground that it “simply performed as the Government directed.” Id.
But that is beside the point. To claim immunity, KeyPoint had to establish “compliance with all federal directions” pertaining to its relevant conduct, including the regulatory and contractual obligation to meet the Privacy Act‘s standards in its contract operations. Campbell-Ewald, 136 S. Ct. at 673 n.7.
So what matters for derivative sovereign immunity purposes is KeyPoint‘s (i) inability to point to a contractual provision or other OPM direction authorizing or directing the very gaps in security protections over which Arnold Plaintiffs are suing, and (ii) its regulatory duty to ensure informational security equivalent to that demanded by the Privacy Act.
The district court also pointed to
* * *
Even under the district court‘s reading,
After all, the driving purpose of derivative sovereign immunity “is to prevent the contractor from being held liable when the government is actually at fault but is otherwise immune from liability.” In re World Trade Center Disaster Site Litig., 456 F. Supp. 2d 520, 560 (S.D.N.Y. 2006) (internal quotation marks omitted), aff‘d, 521 F.3d 169 (2d Cir. 2008); cf. Filarsky v. Delia, 566 U.S. 377, 390-391 (2012) (if qualified immunity is withheld from private individuals “acting on behalf of the government,” “government employees will often be protected from suit by some form of
In any event, the district court overread the statute. When the Privacy Act speaks of contractors as “employees” of the agency, it does so for the purpose of extending criminal liability to contractors and their employees if they violate certain Privacy Act requirements.
As for the district court‘s reliance on
Beyond that, KeyPoint‘s argument frequently mixes apples and oranges, citing preemption cases in an effort to substantiate its claim to derivative immunity. KeyPoint Br. 24-26. That tactic will not work. Those preemption cases do not turn on the applicability of derivative sovereign immunity. And KeyPoint has not raised a preemption argument in this court, so any argument to that effect is forfeited for purposes of this appeal. See Al-Tamimi v. Adelson, 916 F.3d 1, 6 (D.C. Cir. 2019) (“A party forfeits an argument by failing to raise it in his opening brief.“).
In sum, derivative sovereign immunity has its limits. KeyPoint exceeded those limits, and for that reason cannot don the cloak of derivative sovereign immunity.
V
Finally, we turn to NTEU Plaintiffs’ constitutional claim. In that claim, NTEU Plaintiffs do not allege that OPM intentionally disclosed the records at issue or performed the functional equivalent of such a disclosure. See, e.g., NTEU Plaintiffs’ Compl. ¶ 97, J.A. 186 (alleging “reckless indifference“). Instead, NTEU Plaintiffs challenge OPM‘s internal record-management and storage practices and policies as unconstitutionally trenching on their asserted constitutional right to privacy. See, e.g., id. at 3, J.A. 155 (“Although on notice of serious flaws in its data system security, OPM failed to adequately secure personal information in its possession—a failure that was reckless under the circumstances.“). They appear to rely on two closely related threads of constitutional doctrine, one couched in terms of privacy and relying mainly on dicta from Whalen v. Roe, 429 U.S. 589 (1977), the other phrased more directly in terms of substantive due process and relying mainly on cases providing relief for persons harmed through government neglect of their personal safety. We address them in that order.
A
As NTEU Plaintiffs see it, the Constitution creates a “zone of privacy” that protects an individual‘s “interest in avoiding disclosure of personal matters.” NTEU Br. 36 (quoting Whalen, 429 U.S. at 598-599). This putative right to “informational privacy,” they contend, is violated not only where government agents intentionally disclose an individual‘s personal information, but where, as alleged here,
Even assuming “without deciding[] that the Constitution protects” some “sort” of privacy “interest in avoiding disclosure of personal matters,” NASA v. Nelson, 562 U.S. 134, 138 (2011) (quoting Whalen, 429 U.S. at 599-600), NTEU Plaintiffs have failed to state a legally cognizable claim. There is no authority for their contention that the Constitution imposes on the government an affirmative duty—untethered to specific constitutional provisions such as the First Amendment, see, e.g., Americans for Prosperity Found. v. Becerra, 903 F.3d 1000, 1019 (9th Cir. 2018)—to “safeguard personal information” from the criminal acts of third parties, NTEU Plaintiffs’ Compl. ¶ 97, J.A. 186.
The asserted duty to “adequately secure” government computer networks finds no support in the Constitution or our history. NTEU Plaintiffs’ Compl. 3, J.A. 155. Not once do NTEU Plaintiffs quote the very document from which they purport to derive their claimed right: the
NTEU Plaintiffs instead ground their claim in a single line of Supreme Court dictum from more than 40 years ago that describes “[t]he cases sometimes characterized as protecting ‘privacy‘” as involving, among other interests, a vague “individual interest in avoiding disclosure of personal matters.” NTEU Br. 36 (quoting Whalen, 429 U.S. at 599). But neither we nor the Supreme Court has ever held that this interest is a constitutional right. American Fed‘n of Gov‘t Employees v. Department of Hous. & Urban Dev., 118 F.3d 786, 791 (D.C. Cir. 1997) (“The Supreme Court has addressed the issue in recurring dicta without, we believe, resolving it.“). Both courts have, so far, steadfastly rejected all informational privacy claims purporting to rest on the Constitution, while simply “assum[ing]“—but never “deciding“—that the Constitution protects a “right of the sort mentioned in Whalen.” NASA, 562 U.S. at 138; see Nixon v. Administrator of Gen. Servs., 433 U.S. 425, 457-458 (1977); Whalen, 429 U.S. at 605; American Fed‘n of Gov‘t Employees, 118 F.3d at 791. Indeed, neither this court nor the Supreme Court has ever elaborated on the rationale for—or even defined the “precise contours of“—the putative right to informational privacy. American Fed‘n of Gov‘t Employees, 118 F.3d at 793; see also, e.g., NASA, 562 U.S. at 147-148. Rather, we have underlined its “ambiguity.” National Fed‘n of Fed. Employees v. Greenberg, 983 F.2d 286, 293 (D.C. Cir. 1993); cf. Siegert v. Gilley, 500 U.S. 226, 233-234 (1991) (holding that even malicious government defamation does not trigger constitutional protection) (citing Paul v. Davis, 424 U.S. 693 (1976)).
Other circuits, to be sure, have embraced a form of the putative right. See, e.g., In re Crawford, 194 F.3d 954, 958 (9th Cir. 1999); see also NASA, 562 U.S. at 146 n.9 (collecting cases). But see Doe v. Wigginton, 21 F.3d 733, 740 (6th Cir. 1994). But NTEU Plaintiffs have identified no case in which the government has been held to have violated the alleged
Troubled as we are by NTEU Plaintiffs’ allegations regarding the severity and scope of OPM‘s data security shortcomings, we are nonetheless reluctant to constitutionalize an information security code for the government‘s “internal operations.” NASA, 562 U.S. at 151 (citing Engquist v. Oregon Dep‘t of Agric., 553 U.S. 591, 598-599 (2008)). OPM “collect[ed] and store[d]” the information at issue here not as sovereign, but as employer—in “its role as the federal civil service‘s personnel manager.” NTEU Plaintiffs’ Compl. ¶ 10, J.A. 159. In this capacity—“as proprietor and manager of [the government‘s] ‘internal operation,‘” NASA, 562 U.S. at 148 (quoting Cafeteria & Rest. Workers Union v. McElroy, 367 U.S. 886, 896 (1961))—OPM was “dealing ‘with citizen employees,‘” and thus had a “much freer hand” than it would have had if it had brought “its sovereign power to bear on citizens at large,” id. (emphasis added) (quoting Engquist, 553 U.S. at 598). That “freer hand” exists for good reason. Whereas the “Constitution requires that a President chosen by the entire Nation oversee the execution of the laws,” albeit by a “vast and varied federal bureaucracy,” Free Enter. Fund v. Public Co. Accounting Oversight Bd., 561 U.S. 477, 499 (2010), constitutionally micromanaging employment records management systems, reaching down to the details of “how [best] to protect” the “information systems” holding employee data, NTEU Br. 48, would shift a material part of that oversight function to the judiciary, which generally lacks established standards or guideposts for making such administrative judgments—at least in the absence of congressional direction. Cf. Bishop v. Wood, 426 U.S. 341, 349-350 (1976).
Another reason counsels hesitation. Establishing judicial supervision over the security of the government‘s employee data would “short-circuit” the response that Congress has already launched. District Attorney‘s Office for Third Judicial Dist. v. Osborne, 557 U.S. 52, 73 (2009) (citing Glucksberg, 521 U.S. at 720). As the Supreme Court observed in NASA, Congress has in the Privacy Act adopted significant “protections against disclosure” of personal information that “evidence a proper concern for individual privacy.” 562 U.S. at 156 (quoting Whalen, 429 U.S. at 605). Here, as there, the Act limits the government‘s ability to maintain records “about an individual,”
Establishing a freestanding constitutional right to informational privacy that creates a duty to safeguard personal information from unauthorized access by third parties would force us to develop a labyrinth of technical rules. See Osborne, 557 U.S. at 73-74. For example, does the Constitution require data “encrypt[ion]“? NTEU Br. 6 (citing NTEU Plaintiffs’ Compl. ¶¶ 51-52, J.A. 172-173). If so, must all data be encrypted in transit, as well as at rest? Cf. Arnold Plaintiffs’ Compl. ¶¶ 136, 223, J.A. 75, 98. What of the encryption key: Is 256 bits necessary—or would 128 bits scrape by, constitutionally speaking? See Orin S. Kerr & Bruce Schneier, Encryption Workarounds, 106 Geo. L.J. 989, 993 (2018) (illustrating the difference). How about “personal identity verification (PIV) credentials“—are they constitutionally mandated? NTEU Plaintiffs’ Compl. ¶ 47, J.A. 171 (internal quotation marks omitted). And most significant: What “tools” should “federal courts * * * use to answer” these questions? Osborne, 557 U.S. at 74. NTEU Plaintiffs do not say; more important, neither does the Constitution.
We therefore hold that, assuming (without deciding) the existence of a constitutional right to informational privacy, see, e.g., NASA, 562 U.S. at 138; American Fed‘n of Gov‘t Employees, 118 F.3d at 791, it affords relief only for intentional disclosures or their functional equivalent—which NTEU Plaintiffs do not allege.
B
NTEU Plaintiffs also seek to ground their claim in the
But the conscience‘s susceptibility to shock varies radically with whether the government has previously taken an “affirmative act of restraining the individual‘s freedom to act on his own behalf—through incarceration, institutionalization, or similar restraint of personal liberty.” DeShaney v. Winnebago Cnty. Dep‘t of Soc. Servs., 489 U.S. 189, 200 (1989). Thus, a prisoner who has “already been deprived of [his] liberty,” for example, has a plausible claim to affirmative governmental protection. Collins v. City of Harker Heights, 503 U.S. 115, 127 (1992); see also Smith, 413 F.3d at 94-95 (same for “juvenile delinquent held ‘against his will‘“). Absent such a restraint, however, the government‘s “failure to protect an individual from private [acts], even in the face of known danger, [generally] ‘does not constitute a violation of the Due Process Clause.‘” Butera v. District of Columbia, 235 F.3d 637, 647 (D.C. Cir. 2001) (quoting DeShaney, 489 U.S. at 197). “The state must protect those it throws into snake pits, but the state need not guarantee that volunteer snake charmers will not be bitten.” Walker v. Rowe, 791 F.2d 507, 511 (7th Cir. 1986) (explaining that although a state has a constitutional duty to protect prisoners in
Here, NTEU Plaintiffs’ claims fall on the wrong side of this line; they assert an affirmative government duty to safeguard personal information that current and prospective employees voluntarily submitted to the government.
This lack of compulsion makes all the difference. In Collins, for example, the Supreme Court rejected the claim—made by the widow of a city sanitation worker killed in the performance of his duties—that the Due Process Clause required the government to “provide its employees with certain minimal levels of safety and security.” 503 U.S. at 127. A government employee, the Court reasoned, could not maintain “that the [government] deprived [him] of his liberty” and thus incurred a “continuing obligation” to protect that liberty by guaranteeing him a minimum level of safety and security—“when it made, and he voluntarily accepted, an offer of employment.” Id. at 128. That is precisely why, applying the principle in cases posing the distinction most directly, we have rejected claims by prison guards. See Fraternal Order of Police Dep‘t of Corrs. Labor Comm. v. Williams, 375 F.3d 1141, 1147 (D.C. Cir. 2004); Washington v. District of Columbia, 802 F.2d 1478, 1482 (D.C. Cir. 1986).
Similar logic applies here. Like the sanitation worker in Collins—and the prison guards in Williams and Washington—NTEU Plaintiffs “voluntarily” sought and “accepted” an “offer of [government] employment.” Collins, 503 U.S. at 128. In doing so, they voluntarily submitted personal information “as part of a background investigation.” NTEU Plaintiffs’ Compl. ¶ 60, J.A. 176. In no sense, then, did the government compel NTEU Plaintiffs to seek government employment; it therefore bore no constitutional duty under the Due Process Clause to protect them from the risks associated with applying for such positions. With no triggering deprivation of liberty or property to speak of, there arose no constitutional governmental duty to “provide [NTEU Plaintiffs] with certain minimal levels of safety and security,” Collins, 503 U.S. at 127—physical or digital.
VI
In sum, we reverse in part and affirm in part. We hold that (i) NTEU and Arnold Plaintiffs have adequately alleged Article III standing; (ii) Arnold Plaintiffs have stated a claim under the Privacy Act, which waives OPM‘s sovereign immunity; (iii) KeyPoint is not protected by derivative sovereign immunity; and (iv) NTEU Plaintiffs have failed to state a claim that flaws in OPM‘s information-storage measures violated the Constitution. We remand for further proceedings consistent with this opinion.
So ordered.
WILLIAMS, Senior Circuit Judge, concurring in part and dissenting in part:
Why did “sophisticated” cyberintruders spend several months systematically and covertly extracting 21.5 million highly sensitive background investigation records for federal government employees from the Office of Personnel Management? Arnold Plaintiffs’ Compl. ¶ 128, J.A. 73. Plaintiffs’ answer is identity theft. Might the hackers have been members of a criminal syndicate looking to sell the information to identity thieves on the dark web to bilk victims such as Mr. Travis Arnold out of “approximately $125“? Id. ¶ 13, J.A. 40. Yes, theoretically. But as a basis for standing for most Arnold Plaintiffs the garden-variety identity theft theory lacks the necessary
My colleagues do not deny the possibility. See Maj. op. 17 (“[A] cyberattack on a government system might well be motivated by a purpose other than identity theft....“). Yet, in assessing standing, they conclude that “all” 21.5 million Arnold Plaintiffs have “plausibly alleged a substantial risk” that they will, due to this particular data breach, suffer “future identity theft.” Id. at 14, 25.
Respectfully, I disagree. Because Arnold Plaintiffs have failed to allege facts that would tend to negate the “obvious alternative explanation” for the breach (i.e., espionage), they have not, in my view, “nudged [their] claims * * * across the line from conceivable to plausible.” Iqbal, 556 U.S. at 680, 682 (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 567, 570 (2007)). I would therefore affirm the dismissal of Arnold Plaintiffs’ claims for lack of standing—with one exception, discussed below. As a result, I join the court‘s opinion in full except with respect to any portions that are inconsistent with this dissent, including but not limited to Parts II.B (holding that Arnold Plaintiffs stated a plausible claim to standing) and III.B.2 (holding that Arnold Plaintiffs stated a plausible claim that their injuries were the “result of” the breach).
* * *
Two aspects of the standing analysis are important here. First, standing “depends on the facts as they exist[ed] when the complaint [was] filed.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 569 n.4 (1992) (emphasis removed) (quoting Newman-Green, Inc. v. Alfonzo-Larrain, 490 U.S. 826, 830 (1989)). We therefore look, not to the apparent risk of future identity theft in, say, May 2014—the date of the first major breach, see Arnold Plaintiffs’ Compl. ¶ 127, J.A. 73—but to the risk apparent in March 2016, when Arnold Plaintiffs filed their operative complaint.
Second, standing “must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the litigation.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (quoting Lujan, 504 U.S. at 561). Thus, “at the motion to dismiss stage,” Arnold Plaintiffs’ standing allegations must satisfy the pleading requirements of Twombly and Iqbal—that is, the complaint must state “a plausible claim” that each element of standing is satisfied. Hancock v. Urban Outfitters, Inc., 830 F.3d 511, 513 (D.C. Cir. 2016) (quoting Iqbal, 556 U.S. at 678-79). This standard “asks for more than a sheer possibility,” Iqbal, 556 U.S. at 678, that Arnold Plaintiffs faced a “substantial risk” that future injury would occur, Susan B. Anthony List, 573 U.S. at 158 (quoting Clapper v. Amnesty Int‘l USA, 568 U.S. 398, 414 n.5 (2013)). Facts “that are ‘merely consistent with‘” a substantial risk of
Under these standards, most Arnold Plaintiffs lack standing. This is not your typical case, where hackers break into a commercial entity‘s servers and steal consumer information. In those cases, it is generally fair to infer—as this court has inferred—that the hackers plan to, “sooner or later,” “make fraudulent charges or assume [the victims‘] identities.” Attias v. Carefirst, Inc., 865 F.3d 620, 628-29 (D.C. Cir. 2017) (quoting Remijas v. Neiman Marcus Grp., 794 F.3d 688, 693 (7th Cir. 2015)). “Why else would hackers break into a ... database and steal consumers’ private information?” Id. at 628 (alteration in original) (quoting Remijas, 794 F.3d at 693). In such cases there‘s no obvious alternative explanation.
But here there is. In this case, hackers infiltrated a government system and stole sensitive “government investigation information,” Arnold Plaintiffs’ Compl. ¶ 1, J.A. 36, about government employees shortly after a cyberattack on the same agency had “compromised critical security documents,” id. ¶ 3, J.A. 37. It is thus fair to infer, as the majority quite rightly recognizes, that the hackers “might well [have been] motivated by a purpose other than identity theft,” Maj. op. 17, such as obtaining secret information from the persons in the files by extortion or surveillance, enlisting them as agents, obtaining leverage over American businesses, or otherwise jeopardizing U.S. national security, see Br. of Chamber of Commerce of U.S. as Amicus Curiae in Support of Appellees 6; cf. Arnold Plaintiffs’ Compl. ¶ 1, J.A. 36 (explaining that exposed and stolen information includes “private facts collected in federal background and security clearance investigations“); see also id. ¶ 129, J.A. 73-74 (specifying that the theft covered “many million questionnaire forms containing highly sensitive personal, family, financial, medical, and associational information“). This espionage motive is, as Iqbal and Twombly put it, an “obvious alternative explanation“—an explanation that Arnold Plaintiffs, to survive a motion to dismiss, must deflect. Iqbal, 556 U.S. at 682 (quoting Twombly, 550 U.S. at 567).
This they fail to do. Just as “parallel conduct” in Twombly “does not suggest conspiracy” in antitrust cases because it is consistent with “independent action” in competitive markets, Twombly, 550 U.S. at 556-57; and just as detention of “thousands of Arab Muslim men” in Iqbal does not suggest discrimination because (given the identity of the September 11th attackers) it is consistent with legitimate law enforcement activity, Iqbal, 556 U.S. at 681-82, so too a “cyberattack on a government system” does not suggest identity theft (of the type alleged by plaintiffs) because it is consistent with an obvious alternative explanation—foreign espionage, Maj. op. 17; see also Beck v. McDonald, 848 F.3d 262, 274 (4th Cir. 2017) (finding no standing based on a “risk of future identity theft” where there is no evidence that the thief stole the laptop “with the intent to steal [plaintiffs‘] private information“).
What of dual motives, asks the majority? Couldn‘t the hackers have been interested in espionage and identity theft? Maj. op. 18. Yes, that‘s conceivable. But does the conceivability actually render plaintiffs’ theory plausible? I don‘t think so. The majority invokes a syllogism: Because “espionage and identity theft are not mutually exclusive,” it follows that ascribing an “espionage-related motive” doesn‘t “render[] implausible” an allegation of “future risk
So while a foreign government might theoretically have enlisted “sophisticated” hackers to execute a “massive” cyberattack on the U.S. government over the course of “several months” to steal highly “sensitive” information, Maj. op. at 21, both to (i) compromise U.S. national security and (ii) commit fraud by (for example) purchases through an unauthorized Best Buy account (Arnold Plaintiffs’ Compl. ¶ 39, J.A. 54), this dual-motive hypothesis seems fanciful for at least two reasons. First, the goal of identity theft is financial gain. The notion that a foreign state pursuing a complex, risky, and possibly expensive cyberespionage scheme would have as even one of its goals the extraction of small-potatoes sums from individuals by, e.g., filing fraudulent returns with the United States IRS or creating a “My Social Security” account, see id. ¶¶ 14, J.A. 40-41, falls far short of plausibility. Second, and more important, a foreign power seeking leverage over the United States would be most unlikely to permit its agents to use or sell the data for identity theft purposes, as doing so would risk sabotaging the espionage goal. If data gleaned from the hack is slated for counterintelligence use, identity theft would undercut this aim by alerting victims and causing them to alter their data. Since the expected value of successful counterintelligence likely far exceeds that of identity theft, an espionage explanation affirmatively suggests that identity theft will not co-occur. And that is precisely what the record suggests. There is, as discussed below, a striking dearth of allegations as to any pattern of unusual or higher-than-ordinary identity theft or fraud among Arnold Plaintiffs. What readily comes to mind is an obvious alternative explanation—hacking focused entirely on pursuit of espionage and kindred threats to national security.
Thus the Sixth Circuit‘s caution—that “[f]erreting out the most likely reason for the defendants’ actions is not appropriate at the pleadings stage,” Watson Carpet & Floor Covering, Inc. v. Mohawk Industries, Inc., 648 F.3d 452, 458 (6th Cir. 2011)—is inapt here. The court states in the immediately preceding sentence: “Often, defendants’ conduct has several plausible explanations.” Id. (emphasis added). Sorting out which among them is “most likely” is, indeed, out of bounds at the pleadings stage. Yet the whole thrust of my argument is that we haven‘t got “several plausible explanations.” We have one alleged theory—identity theft—that, I argue, is not plausible in view of an obvious alternative explanation of far greater probability. Though it‘s unimpeachable logic to say that “[t]he plausibility of [one particular] reason for the refusals to sell carpet does not render all other reasons implausible,” id., the point—made in context of a discussion of “several plausible explanations“—is not at play here, and marshaling it only begs the question whether identity theft is, in fact, a plausible explanation.
The majority generally agrees, conceding that the “passage of two years in a run-of-the-mill data breach might, absent allegation of subsequent data misuse, suggest that a claim of future injury is less than plausible.” Maj. op. 21. Yet my colleagues think such an inference is not fair game here, where the breach occurred on “a massive scale” reflecting “a relatively new phenomenon.” Id. Large-scale hacking is no doubt a recent phenomenon. But I can think of no attributes of such phenomena or their possible novelty that would invalidate a common sense expectation that future identity-theft-type injuries will become less plausible as time drags on without result. Whatever else may be true, if identity theft is an operative motive, time remains of the essence, given that much personal data—credit card numbers, bank account information, addresses—can go stale with time. If anything, the special features of this case make the passage of time exceptionally forceful in undermining plaintiffs’ theory. The extraordinary volume of people affected and the exceptional sensitivity and range of the information captured should make it relatively easy to discern a “pattern of identity theft or financial fraud” among the pool of 21.5 million potential victims (and litigants)—if there is one. Id. And yet, as the majority agrees, we have no “clearly identifiable pattern of identity theft or financial fraud” in the Complaint. Id.
To be sure, “certain Arnold Plaintiffs have already had fraudulent accounts opened and tax returns filed in their names.” Maj. op. 19. But that is hardly probative. “In a society where around 3.3% of the population will experience some form of identity theft” in a given year, it is “not surprising” that a few plaintiffs in a putative class of 21.5 million would “have experienced some form of credit or bank-account fraud.” In re U.S. Office of Personnel Mgmt. Data Sec. Breach Litig., 266 F. Supp. 3d 1, 38 (D.D.C. 2017) (quoting In re Science Applications Int‘l Corp. Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 32 (D.D.C. 2014)). A handful of Arnold Plaintiffs, for instance, almost certainly experienced a home invasion since the data breach. But that doesn‘t imply a “substantial risk” that these hackers have plans to break into the homes of garden-variety government employees.
In sum, Arnold Plaintiffs have alleged no facts—disproportionate incidence of identity theft, a distinctive pattern of fraud, or anything else of that sort among the putative class—that can credibly nudge their theory into the realm of plausibility in the face of an obvious alternative explanation. So they cannot “all” meet the threshold requirement for standing under the pleading standards of Iqbal and Twombly. Maj. op. 14.
I grant, of course, that in the immediate aftermath of the cyber-intrusion, some putative
* * *
For the subset of Arnold Plaintiffs who, as I see it, have standing, I turn to the issue of sovereign immunity. Arnold Plaintiffs file a battery of state law claims against a contractor that OPM engaged to perform background checks of prospective federal employees. That contractor, KeyPoint Government Solutions, Inc., maintains that, as a government contractor, it is entitled to sovereign immunity. The court, however, disagrees, see Maj. op. Part IV—and I join that part of the opinion in full.
I write separately to address an important distinction between contractor immunity, which KeyPoint asserts, and federal preemption, which KeyPoint fails to raise, and about which the court therefore expresses no views. See, e.g., KeyPoint‘s Br. 25 (distinguishing between preemption and immunity); Oral Arg. Tr. 31:3-21 (same); see also Cunningham v. Gen. Dynamics Info. Tech., Inc., 888 F.3d 640, 646 n.4 (4th Cir. 2018) (same); In re KBR, Inc., Burn Pit Litig., 744 F.3d 326, 342 n.6 (4th Cir. 2014) (same). Contractor immunity, it seems to me, immunizes only those acts that agents of the government are expressly directed by the government to perform—such as building a particular dike as “directed by the Government of the United States.” See, e.g., Yearsley v. W.A. Ross Construction Co., 309 U.S. 18, 20 (1940). Preemption, in contrast, is broader, knocking aside state tort law to the extent that it impermissibly interferes with a contractor‘s ability to perform its federal obligations.
As the Supreme Court explained in Boyle v. United Technologies Corp., there are “a few areas, involving ‘uniquely federal interests,‘” that “are so committed by the Constitution and laws of the United States to federal control that state law is pre-empted and replaced, where necessary, by federal law.” 487 U.S. 500, 504 (1988) (quoting Texas Industries, Inc. v. Radcliff Materials, Inc., 451 U.S. 630, 640 (1981)). The “civil liabilities arising out of the performance of federal procurement contracts” is one of them. Id. at 505-06. That is because “the Federal Government‘s interest in the procurement of equipment is implicated by” state tort suits, even where, as here, “the dispute is one between private parties.” Id. at 506. Specifically, the “imposition of liability on Government contractors will directly affect the terms of Government contracts: either the contractor will decline to manufacture the design specified by the Government, or it will raise its price. Either way, the interests of the United States will be directly affected.” Id. at 507.
To protect these interests, state law may be “displace[d].” Id. at 507. This will occur only where “‘a significant conflict’ exists between an identifiable ‘federal policy or interest and the [operation] of state law,‘” id. (alteration in original) (quoting Wallis v. Pan Am. Petroleum Corp., 384 U.S. 63, 68 (1966)), “or the application of
Here, there is a plausible argument for preemption. This case involves a fundamental federal issue—the hiring, vetting, and protecting of federal employees, and the balancing of the costs of keeping the relevant data secure against the costs of error or neglect in providing that security. And Congress, it seems, has already created a detailed statutory scheme in the form of the Privacy Act to address these (and other) issues. See, e.g.,
KeyPoint, however, has not argued for preemption—only for sovereign immunity. So, while it may press these arguments at future stages of litigation, we need not resolve the issue now.
* * *
This brings me to a final issue—the propriety of five plaintiffs proceeding under pseudonyms. Although some of our sister circuits take the view that a court of appeals has no jurisdiction over plaintiffs who “fail[] to request permission from the district court before proceeding anonymously,” W.N.J. v. Yocom, 257 F.3d 1171, 1172 (10th Cir. 2001); accord, e.g., United States ex rel. Little v. Triumph Gear Systems, Inc., 870 F.3d 1242, 1249-50 (10th Cir. 2017); Citizens for a Strong Ohio v. Marsh, 123 F. App‘x 630, 636-37 (6th Cir. 2005); Nat‘l Commodity & Barter Ass‘n v. Gibbs, 886 F.2d 1240, 1245 (10th Cir. 1989) (per curiam), that doctrine, if adopted by us (which it has not been), would not change our handling of this appeal‘s merits given the presence of other, non-pseudonymous plaintiffs. Moreover, the five anonymous plaintiffs in this case, see Arnold Plaintiffs’ Compl. ¶¶ 22-26, J.A. 44-48, offer reasons that seem highly likely to prove worthy of district court permission—once they request it. But because pseudonymous filing impinges on values key to fair adjudication and a free society, it is hard to see how the district court on remand can avoid the issue once it has been noticed.
Although pseudonymous plaintiffs were once a rarity, there appears now to be a trend permitting adult plaintiffs to litigate incognito, with little more than pro-forma gatekeeping, if any, by the district
Under the “customary and constitutionally-embedded presumption of openness” that inheres in the nature of an Anglo-American trial, those who invoke the state‘s coercive apparatus must do so openly, i.e., under “their real names.” United States v. Microsoft Corp., 56 F.3d 1448, 1464 (D.C. Cir. 1995) (citations omitted); accord, e.g., Doe v. Blue Cross & Blue Shield United, 112 F.3d 869, 872 (7th Cir. 1997) (Posner, J.) (“The people have a right to know who is using their courts.“). For good reason. Public openness may “cause all trial participants to perform their duties more conscientiously,” “induce unknown witnesses to come forward with relevant testimony,” Gannett Co. v. DePasquale, 443 U.S. 368, 383 (1979), and generally foster “an appearance of fairness, thereby heightening respect for the judicial process,” Globe Newspaper Co. v. Superior Court for Norfolk Cnty., 457 U.S. 596, 606 (1982), cf. Richmond Newspapers, Inc. v. Virginia, 448 U.S. 555, 569-73 (1980) (explaining importance of openness in criminal trial context). Of course, it‘s less important that respect for the judicial process be “heighten[ed]” than that it be deserved, which is less likely if plaintiffs can routinely act anonymously. In short, public scrutiny is essential to “the integrity of judicial proceedings.” Metlife, Inc. v. Fin. Stability Oversight Council, 865 F.3d 661, 665 (D.C. Cir. 2017) (quoting United States v. Hubbard, 650 F.2d 293, 315 (D.C. Cir. 1980)).
Indeed, it is a matter of “[b]asic fairness.” Microsoft, 56 F.3d at 1463 (quoting Southern Methodist Univ. Ass‘n of Women Law Students v. Wynne & Jaffe, 599 F.2d 707, 713 (5th Cir. 1979)). A case brought anonymously can let a winning plaintiff inflict “disgrace” on a defendant and can let a losing plaintiff launch defamatory charges “without shame or liability,” Doe v. Smith, 429 F.3d 706, 710 (7th Cir. 2005); see also Wynne, 599 F.2d at 713; even in situations less drastic than Doe v. Smith, allowance of anonymity creates a structural asymmetry that can tilt the scales unfairly. If defendants get named, plaintiffs should too.
The principle of openness is far from an “arcane relic of ancient English law.” Hubbard, 650 F.2d at 315 n.79 (citation omitted).
Anonymity for “rare” or “extraordinary” cases doesn‘t appear to be an apt description of current practice. Cf., e.g., Coe v. Cnty. of Cook, 162 F.3d 491, 498 (7th Cir. 1998) (Posner, J.) (criticizing the “overuse of pseudonyms in federal litigation“). Consider that in the twenty-five-year period between 1945 and 1969, only a single district court decision—anywhere in the country—featured a “John Doe“-like plaintiff as the lead or sole plaintiff (along with a single Supreme Court case reviewing a state court decision and three appellate rulings in administrative appeals). Adam A. Milani, Doe v. Roe: An Argument for Defendant Anonymity When a Pseudonymous Plaintiffs Alleges a Stigmatizing Intentional Tort, 41 Wayne L. Rev. 1659, 1660 (1995); see also Joan Steinman, Public Trial, Pseudonymous Parties, 37 Hastings L.J. 1, 1 n.2 (1985). And in the fifty years since that time, we have never “expressly condoned [the] practice.” Qualls v. Rumsfeld, 228 F.R.D. 8, 9 (D.D.C. 2005). Yet there are now “two different but analogous tests * * * applied in this circuit” to rule on anonymity requests, John Doe Co. v. Consumer Fin. Prot. Bureau, 321 F.R.D. 31, 33 (D.D.C. 2017)—a six-factor test drawn from United States v. Hubbard, 650 F.2d 293, 317-21 (D.C. Cir. 1980), and a five-factor test elaborated in National Association of Waterfront Employers v. Chao, 587 F. Supp. 2d 90, 99 (D.D.C. 2008). Just last year, in this district alone, at least six published district court decisions featured “John Doe” as the lead or sole plaintiff.1 That is to say nothing of the twenty or so other orders that permitted Doe and the like to (anonymously) level
accusations against others; many of those orders were sealed2 or lacked any reasoning at all (thereby omitting the “inquiry” required by Microsoft).3 But cf., e.g.,
Proceedings in this case appear to have gone yet further down the slope of anonymity. Here, five “Does” not only filed anonymously; they evidently never even bothered to ask the district court for permission to do so. The “docket sheet does not reflect any motion or proceeding dealing with whether” John Does I-III or Jane Does I-II “could proceed under pseudonyms.” Marsh, 123 F. App‘x at 636-37. In their amended Complaint the anonymous plaintiffs simply announce, in present participle form, that (for example) John Doe II “is using” a pseudonym “because of his personal safety concerns,” as if such a cursory and conclusory statement suffices as belated justification in lieu of a court‘s permission. Arnold Plaintiffs’ Compl. ¶ 25, J.A. 46. That simply cannot square with the federal rules or our longstanding commitment to openness, much less the rule referred to earlier of treating failure to request permission as fatal to jurisdiction over such parties.
On remand, then, the district court should consider the substantive and procedural questions relating to the Does’ status in the lawsuit.