DOE v. OFFICE OF PERSONNEL MANAGEMENT (2025)

MEMORANDUM OPINION

In late January 2025, the Office of Personnel Management (“OPM”) began to test “ ‘a new capability allowing it to send important communications to ALL civilian federal employees from a single email address,’ ” and OPM subsequently began using this new system to send messages “to most if not all individuals with Government email addresses.” Dkt. 14 at 4–5 (Am. Compl. ¶¶ 20, 22) (emphasis in original) (quoting Statement, OPM, Federal Government-Wide Email Communication Test (Jan. 23, 2025), https://perma.cc/FCX9-2975). That new system uses the email address HR@opm.gov and is known as the “Government-Wide Email System” or “GWES.” Id. at 2–5 (Am. Compl. ¶¶ 10, 21). This putative class action alleges that OPM violated the E-Government Act when it adopted and implemented this new system.

As relevant here, Section 208 of the E-Government Act of 2002 requires federal agencies to prepare a Privacy Impact Assessment (“PIA”) before “initiating a new collection of [certain] information ․ using information technology.” 44 U.S.C. § 3501 note, Pub. L. No. 107-347, § 208, 116 Stat. 2899, 2921–22 (2002) (“E-Government Act”). Plaintiffs are two federal executive branch employees and five other individuals who use “.gov” email addresses but are not executive branch employees. Dkt. 14 at 1–2 (Am. Compl. ¶¶ 3–9). They allege that in the rush to adopt this new system, OPM at first entirely failed to comply with Section 208 and, then, when confronted with that omission, threw together an inaccurate, insufficient, and unconsidered PIA in the hope of mooting the case. Id. at 8–9, 11 (Am. Compl. ¶¶ 36–42, 53–56). According to Plaintiffs, OPM's failure to prepare a meaningful PIA has left vast amounts of private information, including the government email addresses of millions of individuals (which reveal their names and, at least in some cases, their employers) at risk of disclosure in the event that the GWES is hacked.

Now pending before the Court are four motions or requests for relief:

First, OPM moves to dismiss Plaintiffs’ Amended Complaint for lack of subject matter jurisdiction and for failure to state a claim. Dkt. 17. OPM argues that Plaintiffs have failed to allege facts sufficient to support a claim of standing that is plausible on its face. Dkt. 17-1 at 12–14. The agency also maintains that the case is now moot because, after the original Plaintiffs filed suit, OPM conducted and published a PIA. Id. at 14–15. Finally, OPM argues that Plaintiffs’ challenge is unmeritorious because the Court lacks authority under the E-Government Act, the Administrative Procedure Act, or the Declaratory Judgment Act to examine the “substance and accuracy” of the PIA that the agency prepared and, in any event, the existing PIA satisfies the statutory dictates. Id. at 15.

Second, assuming that the Court agrees with OPM that Plaintiffs have failed to allege facts sufficient to clear the modest bar for alleging standing, Plaintiffs seek leave to take jurisdictional discovery. Dkt. 30 at 4–5. Among other things, they seek leave to inquire:

about the security measures [OPM] currently [has] in place around the GWES—such as Security Impact Statements, Security Assessments, Impact Assessments, Risk Assessments, and Security Reviews, which are mandatory for new government systems under the Federal Information Security Modernization Act of 2014, 44 U.S.C. § 3541, et seq., and/or relevant National Institute of Standards and Technology (‘NIST’) cybersecurity standards and guidelines.

Id. at 4.

Third, Plaintiffs move for sanctions, arguing that OPM issued an inaccurate and legally insufficient PIA “at the last minute” in an effort to mislead the Court and to moot the case. Dkt. 28 at 1–2. Plaintiffs further contend that “OPM and its counsel offered false evidence—in the form of an alleged PIA which made patently false statements about the GWES—and then proceeded to argue that this Court should deny Plaintiffs’ [Temporary Restraining Order] motion based on the assertion that those false statements were true.” Id. at 2.

Finally, Plaintiffs move to certify a class that includes “[a]ll individuals who have an email address assigned by an Executive Branch agency ending in .gov or .mil whose Personally Identifiable Information has been stored in the Government-Wide Email System or any system connected to it.” Dkt. 38 at 1. But “in the unlikely event that th[e] Court concludes that Plaintiffs’ estimate [of the size of the class] lacks a sufficiently reasonable basis, Plaintiffs request that th[e] Court permit [them to take] limited pre-certification discovery.” Id. at 8.

For the following reasons, the Court will GRANT Defendant's motion to dismiss, Dkt. 17, for lack of jurisdiction; will DENY Plaintiffs’ request to take jurisdictional discovery; will DENY Plaintiffs’ motion for sanctions, Dkt. 28; and will DENY Plaintiffs’ motion to certify a class or to take pre-certification discovery, Dkt. 38.

I. BACKGROUND

The Court has previously summarized the relevant regulatory and factual background, see Doe v. OPM, No. 25-cv-234, 2025 WL 513268 (D.D.C. Feb. 17, 2025) (“Doe I”), and will repeat and expand on that background only to the extent necessary to resolve the pending motions.

A. Regulatory Background

Congress enacted the E-Government Act in 2022 “to streamline government use of information technology ‘in a manner consistent with laws regarding protection of personal privacy, national security, records retention, access for persons with disabilities, and other relevant laws.’ ” Elec. Priv. Info. Ctr. v. Presidential Advisory Comm'n on Election Integrity, 878 F.3d 371, 375 (D.C. Cir. 2017) (“EPIC I”) (quoting E-Government Act § 2(b)(11)). As explained in its opening clause, “[t]he purpose of [Section 208] is to ensure sufficient protections for the privacy of personal information as agencies implement citizen-centered electronic Government.” E-Government Act § 208(a).

As relevant here, Section 208 imposes the following requirement on all federal agencies:

(A) IN GENERAL.—An agency shall take actions described under subparagraph (B) before—

(i)  developing or procuring information technology that collects, maintains, or disseminates information that is in an identifiable form; or

(ii) initiating a new collection of information that—

(I) will be collected, maintained, or disseminated using information technology; and

(II) includes any information in an identifiable form permitting the physical or online contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, 10 or more persons, other than agencies, instrumentalities, or employees of the Federal Government.

(B) AGENCY ACTIVITIES.—To the extent required under subparagraph (A), each agency shall—

(i)  conduct a privacy impact assessment;

(ii)  ensure the review of the privacy impact assessment by the Chief Information Officer, or equivalent official, as determined by the head of the agency; and

(iii) if practicable, after completion of the review under clause (ii), make the privacy impact assessment publicly available through the website of the agency, publication in the Federal Register, or other means.

E-Government Act § 208(b)(1)(A), (B). To assist in implementing this requirement, Section 208 required the Director of the Office of Management and Budget (“OMB”) to “issue guidance to agencies specifying the required content of a privacy impact assessment” and to “develop policies and guidelines for agencies on the conduct of privacy assessments.” Id. § 208(b)(2)(A), (3)(A).

Consistent with that requirement, OMB issued guidance in 2003 to assist agencies in “implementing the privacy provisions of the E-Government Act of 2002.” Off. of Mgmt. & Budget, Exec. Off. of the President, OMB Mem. M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002 (2003), https://perma.cc/5SCU-63JV (“OMB Guidance”). Among other things, that guidance explains that “[t]he E-Government Act requires agencies to conduct a PIA before ․ developing or procuring IT systems or projects that collect, maintain or disseminate information in identifiable form from or about members of the public.” OMB Guidance, Attach. A § II(B)(a)(1). The guidance further explains that “[n]o PIA is required where information relates to internal government operations,” including where information is collected “for government-run ․ IT systems ․ to the extent that they do not collect or maintain information in identifiable form about members of the general public.” Id. Attach. A § II(B)(c)(1).

When an agency is required to prepare a PIA, the agency's “Chief Information Officer, or equivalent official, as determined by the head of the agency,” must review the PIA, and, “[i]f practicable,” the PIA must then be made “publicly available through the website of the agency, publication in the Federal Register, or other means.” E-Government Act § 208(b)(1)(B). Consistent with the statute, the OMB Guidance specifies that a PIA “must analyze and describe,” among other things, (1) “what information is to be collected;” (2) “why the information is being collected;” (3) the “intended use of the information;” (4) “with whom the information will be shared;” (5) “what opportunities individuals have to decline to provide information ․ or to consent to particular uses of the information ․ and how individuals can grant consent;” (6) “how the information will be secured;” and (7) “whether a system of records is being created under the Privacy Act.” OMB Guidance, Attach. A § II(C)(a)(1); see also E-Government Act § 208(b)(2)(B). In addition, the PIA must “identify what choices the agency made ․ as a result of performing the PIA,” OMB Guidance, Attach. A § II(C)(a)(2), and “[t]he depth and content of the PIA should be appropriate for the nature of the information to be collected and the size and complexity of the IT system,” id. Attach. A § II(C)(b)(1). “Major information systems,” for example, should “reflect more extensive analysis” of the consequences and alternatives to collection, whereas “routine database systems” can be assessed using a “standardized approach (e.g., checklist or template).” Id. Attach. A § II(C)(b)(1)(2), (3).

B. Factual and Procedural Background

For the purposes of resolving OPM's motion to dismiss, the following facts, which are taken from Plaintiffs’ Amended Complaint, are accepted as true. See Am. Nat'l Ins. Co. v. FDIC, 642 F.3d 1137, 1139 (D.C. Cir. 2011). In addition, the Court will consider those undisputed facts that are subject to judicial notice. See Al-Gharawy v. U.S. Dep't of Homeland Sec., 617 F. Supp.3d 1, 8 (D.D.C. 2022).

Three days after the most recent presidential transition, OPM issued a statement announcing that it was “testing a new capability allowing it to send important communications to ALL civilian federal employees from a single email address,” HR@opm.gov. Dkt. 14 at 4–5 (Am. Compl. ¶¶ 20–21) (emphasis in original) (citation omitted). Shortly thereafter, OPM sent several email messages to large swaths of the executive branch workforce, and, perhaps inadvertently, to a host of others, including (apparently) members and staff of the federal judiciary, id. at 4 (Am. Compl. ¶¶ 22–24), government contractors, state employees with .gov email addresses, and employees of agencies in the legislative branch, such as the Library of Congress, id. at 2, 5 (Am. Compl. ¶¶ 7–9, 23). OPM launched this effort without preparing a PIA in advance.

On January 27, 2025 “an unknown ‘OPM employee for nearly a decade and a Federal Employee for almost 20 years’ ” posted a message (“FedNews Message”) on a Reddit discussion board, r/FedNews—a post that has since been deleted but was later screenshotted and re-posted. Id. at 6 (Am. Compl. ¶ 27). According to the FedNews Message, OPM's former Chief Information Officer Melvin Brown “was pushed aside just one week into his tenure because he refused to setup [sic] email lists to send direct communications to all career civil servants,” even though “[s]uch communications are normally left up to each agency.” Id. (Am. Compl. ¶ 28) (citation omitted). The FedNews Message continued:

Instead [of using the normal channels], an on-prem (on site) email server was setup [sic]. Someone literally walked into our building and plugged in an email server to our network to make it appear that emails were coming from OPM. It's been the one sending those various “test” message[s].

Id. at 7–8 (Am. Compl. ¶ 32) (alterations in original). On February 3, 2025, another internet source, Musk Watch, reported that “according to an OPM staffer,” “[a] new server being used to control these [OPM] databases has been placed in a conference room that Musk's team is using as their command center.” Id. at 8 (Am. Compl. ¶ 33) (second alteration in original) (citation omitted).

Two federal employees initiated this action on January 27, 2025, alleging that OPM was acting in violation of Section 208 of the E-Government Act, Dkt. 1 at 1–2, 6 (Compl. ¶¶ 3–4, 28), and they filed a motion for a Temporary Restraining Order (“TRO”) on February 4, 2025, Dkt. 4. As emergency relief, Plaintiffs sought an order barring OPM from “operat[ing] any computer systems connected to the HR@opm.gov address ․ prior to the completion and public release of a required Privacy Impact Assessment.” Dkt. 4-2 at 1. OPM responded to Plaintiffs’ motion for a TRO the following day and attached to its opposition a “Privacy Impact Assessment for Government-Wide Email System (GWES),” dated the same day that it filed its response, February 5, 2025 (“February 5 PIA”). See Dkt. 10; Dkt. 10-1.

The Court held a hearing on Plaintiffs’ motion on February 6, 2025, and denied the motion as moot. See Min. Order (Feb. 6, 2025). As the Court explained, because OPM had conducted a PIA, the relief that Plaintiffs sought was no longer meaningful: there was no reason for the Court to issue an order barring OPM from using computer systems connected to the HR@opm.gov email address because the condition precedent that Plaintiffs themselves specified had been satisfied. Nor was the Court persuaded by the additional arguments that Plaintiffs’ counsel presented for the first time at the hearing. Plaintiffs’ counsel argued, for example, that the February 5 PIA was inadequate. But, as the Court explained, neither Plaintiffs’ then-pending complaint nor their motion for a TRO challenged the adequacy of the PIA, which post-dated both filings. The Court also expressed skepticism that the two Plaintiffs, both current federal employees, could challenge the PIA, given Section 208's focus on the general public.

On February 7, 2025, Plaintiffs filed an amended complaint that made two significant changes to their case. Dkt. 14 (Am. Compl.). First, they added five new Plaintiffs, each of whom has a .gov email address but none of whom work in the executive branch of the United States government. Id. at 2 (Am. Compl. ¶¶ 5–9). Second, these and the original Plaintiffs challenged the adequacy of the February 5 PIA. Id. at 9–12 (Am. Compl. ¶¶ 43–61). That same day, the expanded group of Plaintiffs filed a renewed motion for a TRO. See Dkt. 15. On February 11, 2025, OPM responded by opposing Plaintiffs’ renewed motion for a TRO and moving to dismiss Plaintiffs’ Amended Complaint for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). Dkt. 17-1 at 12–20. The Court held a hearing on the renewed TRO motion the following day.

The Court denied Plaintiffs’ renewed motion for a TRO on February 17, 2025, concluding that Plaintiffs had failed to carry their burden of showing that (1) they were likely to succeed on the merits by establishing standing to bring the action, or (2) that they were likely to suffer irreparable injury in the absence of emergency relief. See generally Doe I, 2025 WL 513268. A little over two weeks after OPM filed its motion to dismiss, on February 28, 2025, OPM published an updated PIA. OPM, Privacy Impact Assessment for Government-Wide Email System (GWES) (Feb. 28, 2025), https://perma.cc/9X8D-BWMS (“February 28 PIA”). That same day, Plaintiffs moved for sanctions against OPM and its counsel, Dkt. 28, and OPM timely opposed that motion, Dkt. 29. Plaintiffs also opposed OPM's motion to dismiss and, in the alternative, sought jurisdictional discovery. Dkt. 30. Finally, Plaintiffs moved for class certification or, in the alternative, for leave to take pre-certification discovery, Dkt. 38, and OPM opposed that motion as well, Dkt. 42. Defendant's motion to dismiss, Plaintiffs’ request for leave to take jurisdictional discovery, Plaintiffs’ motion for sanctions, and Plaintiffs’ motion for class certification or, in the alternative, for leave to take pre-certification discovery, are all now ripe for decision.

II. ANALYSIS

A. Article III Standing

The Court starts, as it must, with the threshold jurisdictional issue of standing. See Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 94, 102, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). It is well-trodden ground that the “irreducible constitutional minimum” of Article III standing, Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (“Lujan”), consists of three elements: injury in fact, causation, and redressability, id. A plaintiff must show “(1) an injury in fact that is concrete and particularized as well as actual or imminent; (2) a causal connection between the injury and the challenged conduct; and (3) a likelihood, as opposed to mere speculation, that the injury will be redressed by a favorable decision.” Nat. Res. Def. Council v. Wheeler, 955 F.3d 68, 76 (D.C. Cir. 2020) (citation modified). As the parties invoking federal jurisdiction, Plaintiffs “bear[ ] the burden of establishing” the elements of standing. Lujan, 504 U.S. at 561, 112 S.Ct. 2130.

The Court's approach to standing varies depending on the stage of the litigation, id., and the nature of the challenge. At the motion-to-dismiss stage, a challenge to the court's subject matter jurisdiction can take one of two forms: a “facial” challenge or a “factual” challenge. Ranchers-Cattlemen Action Legal Fund, United Stockgrowers of Am. v. U.S. Dep't of Agric., 573 F. Supp. 3d 324, 332 (D.D.C. 2021). A facial challenge examines whether the Plaintiffs allege facts sufficient to establish the court's jurisdiction, while a factual challenge asks the court to “consider the complaint supplemented by undisputed facts evidenced in the record, or the complaint supplemented by undisputed facts plus the court's resolution of disputed facts.” Herbert v. Nat'l Acad. of Scis., 974 F.2d 192, 197 (D.C. Cir. 1992); see also Phoenix Consulting, Inc. v. Republic of Angola, 216 F.3d 36, 40 (D.C. Cir. 2000). When a defendant brings a facial challenge, the court must accept the factual allegations of the complaint as true and consider those allegations “in the light most favorable to the non-moving party.” Erby v. United States, 424 F. Supp. 2d 180, 182 (D.D.C. 2006). In contrast, when a motion to dismiss is framed as a factual challenge, the court “may not deny the motion ․ merely by assuming the truth of the facts alleged by the plaintiff and disputed by the defendant” but “must go beyond the pleadings and resolve any disputed issues of fact the resolution of which is necessary to a ruling upon the motion to dismiss.” Phoenix Consulting, Inc., 216 F.3d at 40.

Here, OPM's motion to dismiss raises only a facial challenge to Plaintiffs’ standing. OPM does not dispute Plaintiffs’ factual allegations but, instead, argues that those allegations fail to satisfy the minimum requirements for standing. Dkt. 17-1 at 12 (“[A]ny alleged injury ․ is too speculative to establish standing.”); id. (“Plaintiffs allege two sources of injury, neither of which establishes standing.”); Dkt. 33 at 9 (Plaintiffs [fail] to sufficiently allege standing.”). Because OPM challenges only the “legal sufficiency” of Plaintiffs’ standing, Phoenix Consulting, Inc., 216 F.3d at 40, the Court will treat the motion to dismiss as a facial challenge. The Court will, accordingly, accept the allegations of the Amended Complaint as true and will construe the Amended Complaint in the light most favorable to the non-moving party.

The standard for assessing a facial challenge to a party's standing has evolved over the years. At the time the Supreme Court identified the “irreducible constitutional minimum of standing” in Lujan, “general factual allegations of injury resulting from the defendant's conduct [could] suffice” at the motion-to-dismiss stage, since courts “ ‘presume[d] that general allegations embrace[d] those specific facts that are necessary to support the claim.’ ” 504 U.S. at 560–61, 112 S.Ct. 2130 (quoting Lujan v. Nat'l Wildlife Fed'n, 497 U.S. 871, 889, 110 S.Ct. 3177, 111 L.Ed.2d 695 (1990)). That deferential pleading standard, in turn, traced back to Conley v. Gibson, see Nat'l Wildlife Fed'n, 497 U.S. at 889, 110 S.Ct. 3177 (citing Conley v. Gibson, 355 U.S. 41, 45–46, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957)), but the Supreme Court overruled Conley in relevant part in Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 561–63, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007), and Ashcroft v. Iqbal, 556 U.S. 662, 669–70, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). Since then, the D.C. Circuit has applied the more demanding Twombly and Iqbal pleading standard to jurisdictional allegations, just as it has applied that standard to substantive allegations.

To take just one example, in reviewing the district court's dismissal of a complaint “for want of Article III standing” in Arpaio v. Obama, the D.C. Circuit “accept[ed] the well-pleaded factual allegations as true and [drew] all reasonable inferences from those allegations in the plaintiff's favor.” 797 F.3d 11, 19 (D.C. Cir. 2015). But the court also declined to credit “ ‘[t]hreadbare recitals of the elements of [standing]’ ” that were “ ‘supported by mere conclusory statements,’ ” to “assume the truth of legal conclusions,” or to “ ‘accept inferences that [were] unsupported by the facts set out in the complaint.’ ” Id. (first and second alterations in original) (first and second quoting Iqbal, 556 U.S. at 678, 129 S.Ct. 1937, and third quoting Islamic Am. Relief Agency v. Gonzales, 477 F.3d 728, 732 (D.C. Cir. 2007)). Most importantly, tracking Twombly and Iqbal, the D.C. Circuit held that “ ‘[t]o survive a motion to dismiss’ ” for lack of jurisdiction, “ ‘a complaint must contain sufficient factual matter, accepted as true to state a claim [of standing] that is plausible on its face.’ ” Id. (internal quotation marks omitted) (quoting Iqbal, 556 U.S. at 678, 129 S.Ct. 1937); see also Jibril v. Mayorkas, 20 F.4th 804, 813–14 (D.C. Cir. 2021); Kareem v. Haspel, 986 F.3d 859, 865–66 (D.C. Cir. 2021). Assessing the plausibility of a claim to standing is “ ‘a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.’ ” Humane Soc'y of the U.S. v. Vilsack, 797 F.3d 4, 8 (D.C. Cir. 2015) (quoting Iqbal, 556 U.S. at 679, 129 S.Ct. 1937); see also Ranchers-Cattlemen Action Legal Fund, 573 F. Supp. 3d at 332–33.

Here, Plaintiffs’ allegations of injury have evolved over the short course of this litigation, in part due to OPM's publication of the February 5 PIA after Plaintiffs filed their first complaint and motion for a TRO, and OPM's publication of an updated PIA, the February 28 PIA, a couple weeks after the agency moved to dismiss. All that matters for present purposes, of course, are the jurisdictional allegations contained in Plaintiffs’ operative complaint. Those allegations fall into three categories.

First, Plaintiffs allege that they “are being materially harmed” by OPM's failure to conduct and to publish an adequate PIA “because they are being denied information about how” the GWES or any similar “systems—which will be rich in [Personally Identifiable Information (“PII”)] about every member of the class—are being designed and used.” Dkt. 14 at 11 (Am. Compl. ¶ 57). In support of that allegation, Plaintiffs further allege that “OPM has not published a legally sufficient PIA or made such an assessment available for public inspection for any of [the] systems” at issue. Id. (Am. Compl. ¶ 55). They also allege, in conclusory terms, that “[t]he GWES PIA was both factually inaccurate and legally inadequate.” Id. at 9 (Am. Compl. ¶ 42).

Second, Plaintiffs allege that they “stand to continue to be harmed” in the future by OPM's “ongoing” failure to conduct and to publish an adequate PIA because “they will face a reasonably foreseeable risk that their PII will be unlawfully obtained from these unknown systems, much as the data of millions of federal employees were unlawfully obtained from another OPM server in 2014.” Id. at 11 (Am. Compl. ¶ 58). In support of that allegation, Plaintiffs also allege that a new server was set up in an OPM conference room by Elon “Musk's team,” id. at 7–8 (Am. Compl. ¶¶ 32–33) (citation omitted), and, “[u]pon information and belief,” that “server is not sending [the] emails [at issue] securely due to [its] rapid deployment,” id. at 8 (Am. Compl. ¶ 35). Plaintiffs further allege that “[s]tandard email is not encrypted, and it is common practice among hackers—including hackers affiliated with hostile foreign services—to begin attempting to access a new U.S. Government device as soon as they learn of its deployment.” Id.

Third, Plaintiffs allege that they “have a direct interest in ensuring that OPM conducts and publishes a legally sufficient PIA for these systems.” Id. at 11 (Am. Compl. ¶ 59).

Notably, this is the totality of Plaintiffs’ allegations relating to standing, and, under Twombly, Iqbal, and their progeny, one might reasonably argue—without any further analysis—that these allegations are simply too “threadbare” and “conclusory” to suffice. But the Court is required to give Plaintiffs the benefit of the doubt at this early stage of the proceeding, and it will, accordingly, consider each jurisdictional theory in greater detail and will consider further arguments raised in Plaintiffs’ briefs. Ultimately, however, each theory still fails as a matter of law.

1. Informational Injury

Plaintiffs’ first theory of standing requires only brief discussion. Plaintiffs allege a procedural injury—that is, they allege that OPM adopted the GWES without complying with some of the procedural requirements set forth in Section 208 of the E-Government Act and the associated OMB Guidance. See Growth Energy v. EPA, 5 F.4th 1, 27 (D.C. Cir. 2021); Ctr. for Law & Educ. v. U.S. Dep't of Educ., 396 F.3d 1152, 1157 (D.C. Cir. 2005). Although the imminence and redressability requirements are relaxed in procedural injury cases, see Growth Energy, 5 F.4th at 27, “a bare procedural violation, divorced from any concrete harm, [does not] satisfy the injury-in-fact requirement of Article III,” Spokeo, Inc. v. Robins, 578 U.S. 330, 341, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016); see also Summers v. Earth Island Inst., 555 U.S. 488, 496, 129 S.Ct. 1142, 173 L.Ed.2d 1 (2009) (“deprivation of a procedural right without some concrete interest that is affected by the deprivation—a procedural right in vacuo—is insufficient to create Article III standing”). To be sure, an informational injury can at times fill that void. See, e.g., Public Citizen v. U.S. Dep't of Just., 491 U.S. 440, 448–51, 109 S.Ct. 2558, 105 L.Ed.2d 377 (1989); Fed. Election Comm'n v. Akins, 524 U.S. 11, 21, 118 S.Ct. 1777, 141 L.Ed.2d 10 (1998). But this is not such a case.

To allege an informational injury, a plaintiff must allege facts sufficient to show that (1) he or she “has been deprived of information that, on its interpretation, a statute requires the government or a third party to disclose to it” and that (2) the resulting deprivation constitutes “the type of harm Congress sought to prevent by requiring disclosure.” Friends of Animals v. Jewell, 828 F.3d 989, 992 (D.C. Cir. 2016). The D.C. Circuit has twice applied this test to facts similar to those at issue in this case—that is, to an alleged failure to prepare or to publish a PIA pursuant to Section 208 of the E-Government Act—and, in both cases, the court held that the plaintiff lacked standing because it failed to clear the second of these hurdles. See EPIC I, 878 F.3d at 378; Elec. Priv. Info. Ctr. v. U.S. Dep't of Com., 928 F.3d 95, 103–04 (D.C. Cir. 2019) (“EPIC II”); see also Elec. Priv. Info. Ctr. v. U.S. Postal Serv., No. 21-cv-2156, 2022 WL 888183, at *2 (D.D.C. Mar. 25, 2022). Those decisions are controlling here, and they foreclose Plaintiffs’ first theory of standing.

In the first case, EPIC I, a nonprofit organization brought suit against a presidential commission, seeking to enjoin the commission from collecting voter data without first preparing and publishing a PIA under Section 208. 878 F.3d at 375–76. On appeal, the D.C. Circuit held that the organization lacked informational standing because it failed to demonstrate that it had “suffered the type of harm that section 208 of the E-Government Act seeks to prevent.” Id. at 378. The court explained:

Section 208, a “Privacy Provision[ ]” by its very name, declares an express “purpose” of “ensur[ing] sufficient protections for the privacy of personal information as agencies implement citizen-centered electronic Government.” E-Government Act § 208(a). As we read it, the provision is intended to protect individuals—in the present context, voters—by requiring an agency to fully consider their privacy before collecting their personal information. EPIC is not a voter and is therefore not the type of plaintiff the Congress had in mind. Nor is EPIC's asserted harm—an inability to “ensure public oversight of record systems”—the kind the Congress had in mind. Instead, section 208 is directed at individual privacy, which is not at stake for EPIC.

Id. (emphases and alterations in original) (citation omitted).

The second case, EPIC II, is even more on point. In that case, the same nonprofit organization, EPIC, brought suit challenging the Department of Commerce's failure to prepare a PIA before adding a citizenship question to the Census. 928 F.3d at 99–100. The D.C. Circuit again held that EPIC lacked informational standing under the second prong of the test. The court wrote: “Even if § 208 requires the disclosure of PIAs to EPIC's members, the organization cannot show that those members have suffered the ‘type of harm Congress sought to prevent by requiring disclosure.’ ” Id. at 103 (quoting Friends of Animals, 828 F.3d at 992). Going beyond its holding in EPIC I, the D.C. Circuit broadly “reject[ed] the possibility that § 208 can support an informational injury theory, at least in the absence of a colorable privacy harm of the type that Congress sought to prevent through the E-Government Act.” Id. The court explained its rationale as follows:

Section 208 was not designed to vest a general right to information in the public. Rather, the statute was designed to protect individual privacy by focusing agency analysis and improving internal agency decision-making. In this respect, § 208 is fundamentally different from statutes like the Freedom of Information Act (FOIA) where the harm Congress sought to prevent was a lack of information itself. Unlike § 208, FOIA was designed to grant enforceable rights to information in the general public. The “broad mandate of the FOIA is to provide for open disclosure of public information” and to allow citizens “to be informed about what their government is up to.” These purposes stand in contrast with the stated agency-centric purpose of § 208 to “ensure sufficient protections for the privacy of personal information as agencies implement citizen-centered electronic Government.” E-Government Act § 208(a).

Id. (emphasis in original) (citations omitted).

To be sure, in this case, Plaintiffs allege that OPM's omissions pose “a colorable privacy harm,” id., and, thus, one might argue that their allegations fall within the caveat acknowledged in EPIC II for informational harm tied to a privacy interest of the type that Congress sought to protect in the E-Government Act. But Plaintiffs do not make that argument, and for good reason, because EPIC made a similar allegation in EPIC II, id. at 102, and that contention was insufficient to breathe life into the organization's invocation of informational standing. In particular, EPIC alleged that the collection of its members’ citizenship status, “without a PIA,” posed “an imminent, concrete, and particularized privacy injury.” Id. The D.C. Circuit, however, was unpersuaded, holding that the collection of the information, standing alone, did not constitute a privacy violation and that “ ‘it [was] pure speculation to suggest that the Census Bureau [would] not comply with its legal obligations to ensure the privacy of respondents’ data or that those legal obligations [would] be amended.’ ” Id. (quoting New York v. U.S. Dep't of Com., 351 F. Supp. 3d 502, 619 (S.D.N.Y. 2019)). The D.C. Circuit further stressed that it was, if anything, even more speculative to suggest that “a delay in receiving a PIA [would] make the Census Bureau any less likely to comply with” its obligations to protect the data at issue. Id.

As explained in greater detail below, this same reasoning applies here. For present purposes, it suffices to note that Plaintiffs have failed to allege any non-speculative basis to believe that providing Plaintiffs with the additional information that they seek here—that is, a more comprehensive or better prepared or properly executed PIA—would avoid or mitigate “a colorable privacy harm of the type that Congress sought to prevent” by requiring publication of PIAs. Id. at 103. As the D.C. Circuit explained in EPIC II, unlike the Freedom of Information Act (“FOIA”) and similar statutes, Section 208 does not create “a general right to information in the public” but, instead, focuses on “protect[ing] individual privacy by focusing agency analysis and improving agency decision-making.” Id. at 103. Informational standing exists, if at all, only when a plaintiff can explain how the failure to provide information to the public undermined this “agency-centric” purpose. Id. Here, Plaintiff raise no such claim.

The Court, accordingly, concludes that Plaintiffs have failed to allege facts sufficient to invoke informational standing.

2. Procedural Injury and Risk of Future Privacy Harm

Like Plaintiffs’ informational injury theory, their future-harm theory turns on an alleged procedural wrong; they claim that OPM's failure to comply with Section 208 by preparing an adequate PIA has caused—and will continue to cause—“a reasonably foreseeable risk that [Plaintiffs’] PII will be unlawfully obtained.” Dkt. 14 at 11 (Am. Compl. ¶ 58). Framed in this manner, Plaintiffs’ claim implicates two distinct lines of standing analysis.

First, because Plaintiffs allege a procedural violation, they must establish that “(1) the government violated their procedural rights designed to protect their threatened concrete interest, and (2) the violation resulted in injury to their concrete, particularized interest.” Ctr. for Law & Educ., 396 F.3d at 1157. “[T]he procedural standing doctrine ‘does not—and cannot—eliminate any of the “irreducible” elements of standing.’ ” New Hampshire v. Holder, 293 F.R.D. 1, 6 (D.D.C. 2013) (three-judge court) (quoting Fla. Audubon Soc'y v. Bentsen, 94 F.3d 658, 664 (D.C. Cir. 1996) (en banc)). It does, however, “relax[ ] the immediacy and redressability requirements.” Id.; see also Lujan, 504 U.S. at 572 n.7, 112 S.Ct. 2130. As a result, in a procedural injury case, the “litigant has standing if there is some possibility that the requested relief will prompt the injury-causing party to reconsider the decision that allegedly harmed the litigant.” Massachusetts v. EPA, 549 U.S. 497, 518, 127 S.Ct. 1438, 167 L.Ed.2d 248 (2007). The injury-in-fact and causation requirements, in contrast, are not relaxed and apply just as they would in any other case. Ctr. for Law & Educ., 396 F.3d at 1157.

Second, because Plaintiffs do not identify an actual injury that has resulted (or that will surely result) from the agency action at issue but, rather, claim that OPM's failure to prepare an adequate PIA before implementing the GWES has merely increased the risk that they might suffer some future injury (if, for example, the GWES server is hacked and their PII is misappropriated), the Court must apply the D.C. Circuit's “[i]ncreased-risk-of-harm cases.” Food & Water Watch, Inc. v. Vilsack, 808 F.3d 905, 914 (D.C. Cir. 2015).

In a garden-variety procedural injury case, the asserted injury-in-fact is relatively straightforward: an agency, for example, might fail to prepare an Environmental Impact Statement (“EIS”) before licensing the construction of a dam adjacent to the plaintiff's property, and the asserted injury is the aesthetic and/or property loss associated with living next to a dam. See Lujan, 504 U.S. at 572 n.7, 112 S.Ct. 2130. In a case of that type, the plaintiff need not prove “with any certainty” that preparation of an EIS would “cause the license to be withheld” or that the dam would “be completed” in the near future. Id. (explaining the relaxation of the imminence and causation requirements in procedural injury cases). But the plaintiff must still establish a “concrete interest[ ]” that would be affected by constructing the dam—that is, the aesthetic and/or property loss associated with living next to a dam. Id.

A plaintiff must also establish a concrete interest in an increased-risk-of-harm case. But, unlike in a procedural injury case, in an increased-risk-of-harm case, an increased risk of an uncertain future harm is itself treated as a form of concrete injury. Because that loosening of the traditional standard risks drawing the judiciary into disputes best “left to the policymaking Branches,” Public Citizen, Inc. v. Nat'l Highway Traffic Safety Admin., 489 F.3d 1279, 1295 (D.C. Cir. 2007), the D.C. Circuit has imposed additional requirements on plaintiffs who rely on an increased risk of harm to establish their standing. In those cases, the plaintiff must allege (and must ultimately prove) “both (i) a substantially increased risk of harm and (ii) a substantial probability of harm with that increase taken into account.” Id. (emphases in original). Under this standard, “the proper way to analyze an increased-risk-of-harm claim is to consider the ultimate alleged harm—such as death, physical injury, or property damage ․ —as the concrete and particularized injury and then to determine whether the increased risk of such harm makes injury to an individual citizen sufficiently ‘imminent’ for standing purposes.” Id. at 1298; see also Food & Water Watch, Inc., 808 F.3d at 914–15.

With these overlapping frameworks in mind, the Court will first consider whether Plaintiffs have adequately alleged that OPM violated a procedural directive designed to protect Plaintiffs’ concrete interests and will, then, consider whether Plaintiffs have adequately alleged that this purported violation “substantially” increased the risk the Plaintiffs will suffer a privacy-related injury and that, with this increased risk taken into account, there is a “substantial” probability that this harm will come to pass.

a.

For present purposes, the Court need only briefly discuss the first prong of the procedural injury framework and merely notes that Plaintiffs have at least arguably shown that the procedural requirement at issue—the preparation of an adequate PIA—is “designed to protect [a] threatened concrete interest,” Fla. Audubon Soc'y, 94 F.3d at 664 (quoting Lujan, 504 U.S. at 573 n.8, 112 S.Ct. 2130), of the type at issue in this case. The E-Government Act seeks “to ensure sufficient protections for the privacy of personal information as agencies implement citizen-centered electronic Government,” E-Government Act § 208(a), and, here, Plaintiffs allege that OPM's failure to comply with Section 208 has placed their PII at risk of disclosure. Invasions of privacy, including “disclosure of private information” and “intrusion upon seclusion” are concrete injuries with “a close relationship to harms traditionally recognized” in American courts. TransUnion LLC v. Ramirez, 594 U.S. 413, 425, 141 S.Ct. 2190, 210 L.Ed.2d 568 (2021); see also Salazar v. Nat'l Basketball Ass'n, 118 F.4th 533, 541 (2d Cir. 2024) (the “exposure of [a plaintiff's] personally identifiable information to unauthorized third parties” is analogous to harms cognizable under common law rights to privacy).

The Court hesitates to conclude that Plaintiffs have satisfied the first step, however, because the only PII that Plaintiffs identify in their Amended Complaint is their .gov email addresses. See Dkt. 14 at 1–2 (Am. Compl. ¶¶ 3–9). Although Plaintiffs note that the government often invokes the privacy interests of its employees in withholding email addresses in FOIA litigation, Dkt. 24 at 6–7, they fail to point to any authority—or to offer any argument—addressing whether a purported privacy interest in a .gov email address is sufficiently personal and concrete and whether the procedures contained in Section 208 of the E-Government Act are intended to protect any such purported privacy interest. Because Plaintiffs’ claim of standing more clearly falters at the second prong of the test, however, the Court need not address this undeveloped issue.

b.

Under the second prong of the procedural injury framework, Plaintiffs must allege facts sufficient to show that “the government act performed without the procedure in question will cause a distinct risk to a particularized interest of the plaintiff.” Fla. Audubon Soc'y, 94 F.3d at 664. In the context of a procedural injury, this causal inquiry involves two steps. Each poses difficulties for Plaintiffs.

First, Plaintiffs must “connect[ ] the omitted procedural step to some substantive government decision that may have been wrongly decided because of the lack of that procedural requirement.” Growth Energy, 5 F.4th at 27 (citation modified). To resolve that question, the Court must begin by identifying the purported procedural deficiency. Plaintiffs’ perfunctory Amended Complaint does not make that endeavor easy. The Amended Complaint, most notably, fails to identify any specific ways in which the February 5 PIA—much less the February 28 PIA, which was issued after Plaintiffs filed their Amended Complaint—is deficient or omits statutorily required information. Instead, their Amended Complaint merely alleges in conclusory terms that “OPM has not conducted a legally sufficient PIA for the GWES,” Dkt. 14 at 11 (Am. Compl. ¶ 53); that “OPM has not ensured review of a PIA for any of these systems by any legally sufficient Chief Information Officer,” id. (Am. Compl. ¶ 54); and that “OPM has not published a legally sufficient PIA or made such an assessment available for public inspection,” id. (Am. Compl. ¶ 55). The Amended Complaint adds no meat to the bones with respect to any of these assertions. It fails, for example, to describe what OPM should have—but did not—include in the PIA, and it fails to indicate why Greg Hogan, who is listed as OPM's Chief Information Officer and as the “Reviewing Official,” id. at 8–9 (Am. Compl. ¶ 37), was not a “legally sufficient Chief Information Officer,” id. at 11 (Am. Compl. ¶ 54).¹

Even if Plaintiffs were able to supplement the allegations in their Amended Complaint with new contentions raised for the first time in their opposition brief, but see McManus v. District of Columbia, 530 F. Supp. 2d 46, 74 n.25 (D.D.C. 2007) (noting that it “is axiomatic that a complaint may not be amended by the briefs in opposition to a motion to dismiss” (citation modified)), their opposition brief offers no better explanation of what omitted procedural step led OPM to adopt the GWES by mistake. In their opposition brief, Plaintiffs merely list the requirements of Section 208 and repeat the same conclusory allegations that they included in their Amended Complaint. Dkt. 30 at 7–11. To be sure, Plaintiffs do argue that Section 208 requires that an agency conduct and publish a PIA before implementing a new system, and they note that, here, the PIA was prepared after the GWES was implemented. Id. at 9–10. But Plaintiffs fail to explain why the subsequent issuance of the PIA (or PIAs) did not suffice to address the prospective risk of harm upon which their claim of standing hinges.²

Second, even if Plaintiffs’ Amended Complaint cleared the first causal hurdle and adequately alleged a nexus between the purported procedural violation and the “substantive government decision,” it nonetheless fails to clear the second hurdle, which requires Plaintiffs to allege facts sufficient to “connect[ ] that substantive decision to [their] particularized injury.” Growth Energy, 5 F.4th at 27 (citation modified). In the present context, this inquiry is complicated by the fact that Plaintiffs do not allege that the substantive government decision has caused an actual injury, such as the aesthetic and/or property loss associated with living next to a constructed dam but, rather, contend that the government action at issue here merely poses an increased risk of harm. The nature of that alleged harm, in turn, requires the Court to assess the “particularized injury” requirement through the lens of the D.C. Circuit's increased-risk-of-harm cases. Those cases require a plaintiff asserting an increased risk of harm to allege facts that, if accepted as true, would plausibly establish that the substantive agency action that disregarded the procedural requirement created both “a substantially increased risk of harm” and “a substantial probability of harm with th[e] increase[d] [risk of harm] taken into account.” Public Citizen, Inc., 489 F.3d at 1295 (emphasis in original); Food & Water Watch, Inc., 808 F.3d at 914. In this unique context, the second prong of the procedural injury test and the increased-risk-of harm inquiry merge.

In an effort to satisfy this demanding standard, Plaintiffs allege that they face “a reasonably foreseeable risk that their PII will be unlawfully obtained from these unknown systems,” Dkt. 14 at 11 (Am. Compl. ¶ 58), because the insecure GWES is “more vulnerable to hacking,” Dkt. 30 at 3 (emphasis omitted). To support this contention, Plaintiffs make three sets of factual allegations, none of which suffices.

Plaintiffs first point to the 2014 hack of OPM's server, which caused the “data of millions of federal employees [to be] unlawfully obtained.” Dkt. 14 at 11 (Am. Compl. ¶ 58). Second, they assume, “due to [its] rapid deployment,” that the “server is not sending these or other emails securely,” and allege that “it is common practice among hackers—including hackers affiliated with hostile foreign services—to begin attempting to access a new U.S. Government device as soon as they learn of its deployment.” Id. at 8 (Am. Compl. ¶ 35). Finally, they refer to the FedNews Message and the Musk Watch article, which, taken together, report that an “email server was set[ ]up” outside of “normal channels,” id. at 7–8 (Am. Compl. ¶ 32); that the “new server” was “placed in a conference room that [Elon] Musk's team [was] using as their command center,” id. at 8 (Am. Compl. ¶ 33); and that a “staffer described the server as a piece of commercial hardware [the staffer] believed was not obtained through the proper federal procurement process,” id. None of these allegations suffices to meet the “substantially increased risk” test, even at this early stage of the litigation.

Start with the decade-old hack of OPM's databases. Just as a past violation will not suffice to establish injury in fact absent reason to believe it will occur again, see City of Los Angeles v. Lyons, 461 U.S. 95, 105–06, 103 S.Ct. 1660, 75 L.Ed.2d 675 (1983), a single past data breach cannot support the (admittedly lesser) showing that OPM's actions (or inactions) created a “demonstrable risk,” or has “demonstrabl[y]” increased an existing risk, of a future invasion of Plaintiffs’ right to privacy. Fla. Audubon Soc'y, 94 F.3d at 669. Plaintiffs do not, for example, allege any facts suggesting that the same (or similar) privacy vulnerabilities that caused the 2014 cyberattack exist in the present OPM server or that the prospect of obtaining the information at issue here (.gov and .mil email addresses) offers a similar enticement to hacking.

Plaintiffs’ second set of allegations, which refer to the server's assumed lack of security and the “common practice” of hackers, is also too speculative and conclusory to satisfy the requisite causal connection between the GWES server and Plaintiffs’ privacy interests. See Ctr. for Law & Educ., 396 F.3d at 1160 (“the agency action and the alleged injury stand at opposite ends of a long chain”). The fact that the system was rapidly deployed might raise reasonable questions about whether OPM cut any corners, but speed alone does not equate to the type of vulnerability sufficient to establish a demonstrable risk that Plaintiffs’ .gov or .mil email addresses will be unlawfully obtained and exploited to Plaintiffs’ disadvantage.

Plaintiffs’ final set of allegations, which reference the FedNews Message and the Musk Watch article, fares no better. As an initial matter, the Court notes that the Amended Complaint merely alleges that these reports exist and, consistent with those allegations, the Court assumes the truth of the existence of these sources—and not the substance of the critiques (or speculation) contained therein, none of which is set forth in the Amended Complaint. Cf. Sandza v. Barclays Bank PLC, 151 F. Supp. 3d 94, 113 (D.D.C. 2015) (at the motion-to-dismiss stage, court may take judicial notice of newspaper articles for the fact that they contain certain information but may not accept the articles for the truth of their assertions); Hourani v. Psybersolutions LLC, 164 F. Supp. 3d 128, 132 n.1 (D.D.C. 2016) (“The Court takes judicial notice of the [newspaper] articles not for their truth but merely for the fact that they were published.”), aff'd, 690 F. App'x 1 (D.C. Cir. 2017). But, even more importantly, neither the FedNews Message nor the Musk Watch article provides a plausible factual basis to infer that the processes by which the GWES was established or the equipment was procured have created a “substantially increased risk,” Public Citizen, Inc., 489 F.3d at 1295 (emphasis in original), that Plaintiffs’ PII will be misappropriated. The fact that the server: (1) was placed in a conference room used by Elon Musk's team, (2) was quickly established, and (3) was constructed using commercial hardware that was not procured using the usual federal procurement process might, again, raise reasonable questions, but it does not establish a demonstrable risk that Plaintiffs will suffer a future privacy injury.

For essentially the same reasons, Plaintiffs have also failed to allege facts sufficient to satisfy the second step in the increased-risk-of-harm inquiry: they do not allege facts that, if accepted as true, would plausibly establish “a substantial probability of harm with th[e] increase[d] [risk of harm] taken into account.” Id. at 1295 (emphasis in original). Here, OPM asserts that Plaintiffs’ “alleged injury stemming from a hypothetical, future data breach is too speculative to establish standing.” Dkt. 17-1 at 12. For the reasons explained above, the Court agrees. Plaintiffs have failed to allege facts sufficient to show that they face a “substantial probability” that their PII will be misappropriated from the server used to maintain the GWES. Nor do Plaintiffs allege any colorable nexus between the untimely PIA or any other (unidentified) legal insufficiencies in the PIA and a substantial probability that they will suffer a privacy injury. See EPIC II, 928 F.3d at 102 (concluding that plaintiff's “privacy injury theory fail[ed]” because it did not show “how a delayed PIA would lead to a harmful disclosure” (emphasis added)). At most, they simply reference a podcast in which an anonymous “systems security expert” discusses potential vulnerabilities related to the GWES, Dkt. 30 at 3 n.3—a podcast that this Court has carefully reviewed and that fails to establish a “substantial probability” that Plaintiffs’ .gov email addresses (as opposed, for example, to “network appliances” that OPM had installed) will be accessed (and exploited) by hackers at some point in the future. See Allison Gill, A Fork in the Road: Is Federal Employee Privacy Compromised?, Mueller She Wrote (Jan. 29, 2025), https://perma.cc/5MCH-ECZA.³ Indeed, if anything, that podcast suggests that OPM took steps after the GWES's initial deployment to close certain initial vulnerabilities (certain “internal hosts,” for example, were subsequently redacted) and that any public disclosure was “historical,” as opposed to ongoing. Id.

In any event, to the extent Plaintiffs have a theory regarding how the ongoing existence of the GWES (assuming that it remains in use) creates a “substantial probability” that an unlawful, third-party actor will gain access to their .gov email addresses, their Amended Complaint fails to offer any insight about that theory. Merely citing to a lengthy podcast, which acknowledges that it can offer nothing more than speculation about what has happened, cannot satisfy Plaintiffs’ obligation to file a complaint that contains “a short and plain statement of the grounds for the court's jurisdiction.” Fed. R. Civ. P. 8(a)(1).

Separately, the parties quibble about whether the server supporting the GWES collects PII that, even if accessed by unauthorized third parties, would harm Plaintiffs. OPM argues that “Plaintiffs have failed to plausibly allege ․ that disclosure of their government email addresses, if such disclosure occurred, would cause them concrete harm,” Dkt. 33 at 9 (emphasis in original), such as by suggesting that “their association with the government components for whom they work is unknown or not easily discoverable,” id. at 10. Instead of demonstrating how exposure of their government email addresses would constitute a concrete privacy harm, Plaintiffs respond by arguing that the OPM server collects other “sensitive information,” Dkt. 35-1 at 2, as evidenced by two emails sent out by GWES, “instruct[ing] all Executive Branch employees to ‘reply to this email with approx[imately] 5 bullets of what you accomplished last week,’ ” id. at 1. But that argument suffers from two separate problems. First, the Court must assess the sufficiency of Plaintiffs’ Amended Complaint based on the allegations contained in that pleading, and not based on new claims or theories advanced in an opposition brief. See Chin-Teh Hsu v. New Mighty U.S. Tr., No. 10-cv-1743, 2020 WL 588322, at *8 (D.D.C. Feb. 6, 2020). Second, and more decisively, Plaintiffs do not posit that they sent any sensitive information in response to a GWES email. Instead, Plaintiffs assert that members of the putative class undoubtedly disclosed “sensitive” information in responding to these GWES emails. Dkt. 35-1 at 2. But that puts the cart before the horse. If Plaintiffs lack standing, they cannot pursue individual or class-wide relief. See infra Part II.D.

The Court, accordingly, concludes that Plaintiffs have failed to allege facts sufficient to establish standing based on a risk of future harm resulting from an alleged violation of a procedural requirement.

3. Direct Interest in Ensuring Compliance with the Law

Plaintiffs’ final theory of standing—assuming that it is intended as a stand-alone theory—requires only brief discussion. Plaintiffs allege that they “have a direct interest in ensuring that OPM conducts and publishes a legally sufficient PIA for these systems.” Dkt. 14 at 11 (Am. Compl. ¶ 59). Absent a concrete injury of the type discussed above, that type of generalized interest cannot satisfy Article III. As the Supreme Court has “consistently held,” a plaintiff who raises “only a generally available grievance about government—claiming only harm to his and every citizen's interest in proper application of the Constitution and laws, and seeking relief that no more directly and tangibly benefits him than it does the public at large—does not state an Article III case or controversy.” Lujan, 504 U.S. at 574–75, 112 S.Ct. 2130.

* * *

The Court, accordingly, rejects each of Plaintiffs’ theories of standing.

B. Jurisdictional Discovery

Next, the Court considers Plaintiffs’ request for jurisdictional discovery. Dkt. 30 at 4. Plaintiffs, in particular, seek leave to “issue limited written discovery requests to OPM about the security measures currently in place around the GWES ․ and information about attempted or actual cyberintrusions.” Id. OPM, for its part, argues that Plaintiffs are not “entitled to ‘jurisdictional discovery’ to cure their failure to sufficiently allege standing,” Dkt. 33 at 8, because Plaintiffs have failed to “provide any basis for their allegation that any future injury is certainly impending,” id. at 9. The Court agrees that jurisdictional discovery is unwarranted under the present circumstances.

When presented with a factual challenge to standing, courts routinely consider affidavits and other evidence, and they at times permit jurisdictional discovery. See Phoenix Consulting, Inc., 216 F.3d at 40; Prakash v. Am. Univ., 727 F.2d 1174, 1179–81 (D.C. Cir. 1984); Public Citizen, Inc. v. Trump, 297 F. Supp. 3d 6, 16–17 (D.D.C. 2018); Public Citizen, Inc. v. Trump, 361 F. Supp. 3d 60, 92–93 (D.D.C. 2019). When faced with bona fide factual disputes, district courts have discretion to allow a party to obtain jurisdictional discovery if “allegations indicate its likely utility” in determining a party's standing to pursue the case. Nat. Res. Def. Council v. Pena, 147 F.3d 1012, 1024 (D.C. Cir. 1998). But to justify a request for jurisdictional discovery, “the plaintiff must have at least a good faith belief that such discovery will enable it to show that the court has [ ] jurisdiction,” and that belief must be based on more than “conjecture or speculation.” FC Inv. Grp. LC v. IFX Markets, Ltd., 529 F.3d 1087, 1093–94 (D.C. Cir. 2008) (citation modified). Notably, such a “discovery request cannot be a fishing expedition” and must “describe particular ways in which jurisdictional discovery would cure [the] complaint's defect.” Lewis v. Mutond, 62 F.4th 587, 596 (D.C. Cir. 2023) (citation modified). A federal district court “acts well within its discretion to deny discovery when no facts [which] additional discovery could produce would affect [the] jurisdictional analysis.” Id. (citation modified).

A facial challenge to the sufficiency of the jurisdictional allegations contained in a complaint—like the challenge at issue here—is different. When a motion to dismiss poses a facial challenge to standing, courts generally operate “in a manner similar to a motion to dismiss under Rule 12(b)(6),” Hale v. United States, No. 13-cv-1390, 2015 WL 7760161, at *3 (D.D.C. Dec. 2, 2015), and do not consider materials outside the allegations in the pleadings. See Price v. Socialist People's Libyan Arab Jamahiriya, 294 F.3d 82, 93 (D.C. Cir. 2002); Ranchers-Cattlemen Action Legal Fund, 573 F. Supp. 3d at 335–36. Here, as the Court has explained, OPM does not dispute the factual, jurisdictional allegations contained in Plaintiffs’ Amended Complaint and, instead, argues that those allegations, even if true, fail as a matter of law. The parties’ dispute, in other words, does not turn on a dispute of fact, but on the sufficiency of Plaintiffs’ factual allegations.

The question, then, is whether Plaintiffs are entitled to jurisdictional discovery, not to resolve a dispute, but to fill a void in their Amended Complaint. In such circumstances, the Court must strike a balance between disallowing mere fishing expeditions, launched in the hope of finding something that might support a claim of standing, while permitting jurisdictional discovery by a plaintiff with good reason to believe that discovery will prove fruitful. Here, the Court is unpersuaded that Plaintiffs have met their burden of explaining “what facts additional discovery could produce that would affect the court's jurisdictional analysis.” TIG Ins. Co. v. Republic of Argentina, 110 F.4th 221, 240 (D.C. Cir. 2024) (citation modified).

Notably, Plaintiffs’ single-sentence request offers nothing more than a list of documents that they seek. Dkt. 30 at 4. They do not even attempt to explain how those documents are likely to show that OPM's failure to prepare a PIA before implementing the GWES or to include certain (unspecified) information in the PIA, created both a “substantially increased” risk that they will suffer a future privacy injury and a “substantial probability” that they will sustain such a harm in light of that increased risk. Without providing such a detailed justification—or, indeed, any justification at all, see TIG Ins. Co., 110 F.4th at 240 (affirming denial of jurisdictional discovery where moving party “did not offer the district court any explanation of what relevant facts it believed jurisdictional discovery would uncover”)—the Court cannot conclude that Plaintiffs’ request for discovery is based on anything more than “ ‘conjecture or speculation,’ ” Ambellu v. Re'ese Adbarat Debre Selam Kidist Mariam, 406 F. Supp. 3d 72, 82 (D.D.C. 2019) (quoting FC Inv. Grp. LC, 529 F.3d at 1094).

The Court will, accordingly, deny Plaintiffs’ request for jurisdictional discovery.

C. Motion for Sanctions

Next, the Court turns to Plaintiffs’ motion for sanctions under Federal Rule of Civil Procedure 11, 28 U.S.C. § 1927, and the Court's inherent authority. Dkt. 28 at 7–8.⁴ Plaintiffs’ motion for sanctions is premised on what they characterize as four acts of misconduct.

First, Plaintiffs contend that on the eve of the February 6, 2025 TRO hearing, OPM published a PIA and “attached [it] to its brief” in an effort to “render[ ] the case moot,” id. at 3, and to “convince[ ] this Court to deny Plaintiffs’ first request for a TRO,” thereby “forc[ing] the parties to brief a second motion for a TRO, and [ ] forcing Plaintiffs to respond to a motion to dismiss which [was] largely predicated on the [new] PIA,” id. at 9; see also Dkt. 31 at 12 (arguing sanctions are warranted because “Plaintiffs lost on their motion and were required to undertake the burden and expense of additional legal filings due to the false document submitted by defendants”).

Second, Plaintiffs contend that OPM's counsel “intentionally, unreasonably, vexatiously, and in bad faith [filed] a document”—that is, a copy of the February 5 PIA—“containing false information into evidence and argued that the Court should rely on the statements made in that document.” Dkt. 28 at 9. They contend, in particular, that OPM's counsel filed the February 5 PIA in response to Plaintiffs’ initial motion for a TRO, even though the PIA falsely and misleadingly asserted that “any responses to emails sent using the [GWES] [would be] strictly voluntary.” Id. at 3. That assertion proved false, according to Plaintiffs, because various agencies subsequently “directed” their employees to respond to certain GWES emails, id. at 7, such as the email requesting that employees “reply ․ with approx[imately] 5 bullets of what you accomplished last week,” id. at 6. Plaintiffs further contend that the February 28 PIA effectively concedes the falsity of the first, since OPM changed its position regarding the voluntariness of responses to GWES emails. Dkt. 31 at 3. At a minimum, Plaintiffs continue, OPM's counsel failed to conduct a reasonable investigation or inquiry, as required by Rule 11(b)(3), before filing the February 5 PIA. Id. at 12–13.

Third, Plaintiffs contend that OPM's counsel falsely “stated that the GWES PIA was accurate and [misleadingly] referenced the voluntary nature of any responses to emails sent using that system.” Dkt. 28 at 5; see also Dkt. 31 at 2.

Finally, Plaintiffs contend that OPM's counsel “told the Court that the inclusion of contractors and other individuals who were not Executive Branch employees was accidental and that ‘filtering’ has been done to ensure that they did not receive any more emails.” Dkt. 28 at 5. According to Plaintiffs, this too was false, or at the very least, counsel used “carefully chosen words designed to obfuscate the truth” and displayed “willful ignorance.” Dkt. 31 at 13. We know that the assertion was false or misleading, Plaintiffs continue, because a more “recent series of emails sent from the GWES” demonstrate that such individuals were not removed. Id. at 14.

Based on this alleged misconduct, Plaintiffs request that the Court “impose monetary and equitable sanctions on OPM and its counsel,” including “a) striking the GWES PIA from the record; b) prohibiting OPM from relying on the GWES PIA at this stage of the litigation; [and] c) ordering all of OPM's legal team to file sworn declarations and supporting evidence regarding their level of knowledge of the falsity of OPM's representations.” Dkt. 28 at 10.

In response, OPM asserts that none of its conduct or that of its attorneys was sanctionable. OPM notes that the transcripts from the TRO hearings show that counsel did not make misrepresentations, either regarding the February 5 PIA's accuracy or OPM's “remov[al]” of “individuals outside the Executive Branch who received the first GWES email.” Dkt. 29 at 4–5. Instead, OPM asserts, its counsel “argued only that the PIA contained the statutory elements,” id. at 4, and reported that they “had been informed that OPM was working to make sure emails did not go out to any individuals who were not intended to receive them,” id. at 6. OPM further observes that the Court was not “misled into denying [Plaintiffs’] TRO” and, indeed, “the Court's ruling was not based on the content of the PIA” that the agency prepared. Id. at 7. In addition, OPM posits that the February 22 email sent using the GWES “in no way suggests that, at the time of the TRO hearing, the PIA was inaccurate or that OPM's counsel had any reason to believe that it was inaccurate.” Id. (emphasis added). Finally, OPM notes that its counsel expressed uncertainty regarding OPM's future plans with the GWES. Id. at 5–6.

The Court agrees with Defendant that sanctions are unwarranted in this case.

A court may impose sanctions under three sources of authority. First, a court has inherent power to “fashion an appropriate sanction for conduct which abuses the judicial process,” including the “assessment of attorney's fees.” Chambers v. NASCO, Inc., 501 U.S. 32, 44–45, 111 S.Ct. 2123, 115 L.Ed.2d 27 (1991); Shepherd v. Am. Broad. Cos., 62 F.3d 1469, 1472 (D.C. Cir. 1995) (“the inherent power enables courts to ․ guard against abuses of the judicial process”). Such “inherent power” sanctions, such as awarding “attorneys’ fees” or “fines” cannot be imposed unless the court finds “clear and convincing evidence,” Shepherd, 62 F.3d at 1478, of “bad faith,” United States v. Wallace, 964 F.2d 1214, 1219 (D.C. Cir. 1992); see also Chambers, 501 U.S. at 45–46, 111 S.Ct. 2123 (equitable power sanctions are appropriate when a party has “acted in bad faith, vexatiously, wantonly, or for oppressive reasons” (citation modified)).

Second, a court may “require[ ]” “[a]ny attorney or other person admitted to conduct cases in any court of the United States or any Territory thereof who so multiplies the proceedings in any case unreasonably and vexatiously ․ to satisfy personally the excess costs, expenses, and attorneys’ fees reasonably incurred because of such conduct.” 28 U.S.C. § 1927. “Although the standard under section 1927 is somewhat unsettled, attorney behavior must be at least ‘reckless.’ ” Wallace, 964 F.2d at 1217 (emphasis in original); see id. at 1218–19 (noting circuit split and collecting inconsistent cases within D.C. Circuit applying both “subjective bad faith” and “recklessness” standard for attorney misconduct under § 1927). “Nevertheless, all of the courts, including those applying a lesser standard, at minimum agree that unintended, inadvertent, and negligent acts will not support an imposition of sanctions under section 1927.” Id. at 1219 (citation modified). For an act to be considered reckless misconduct, there must be a “conscious choice of a course of action, either with knowledge of the serious danger to others involved in it or with knowledge of facts which would disclose this danger to any reasonable man.” Id. at 1220 (quoting Restatement (Second) of Torts § 500 cmt. g (A.L.I. 1964)).

Finally, under Rule 11, a court may grant a motion to impose sanctions on an attorney or party when “a pleading, written motion, or other paper” filed with the court is “presented for any improper purpose,” or if “factual contentions” in such documents lack “evidentiary support.” Fed. R. Civ. P. 11(b). “The test for sanctions under Rule 11 is an objective one that asks whether a reasonable inquiry would have revealed that there was no basis in law or fact for the asserted claim.” Hedgeye Risk Mgmt., LLC v. Heldman, 412 F. Supp. 3d 15, 34 (D.D.C. 2019). “The Court must also take into consideration that Rule 11 sanctions are a harsh punishment, and what effect, if any, the alleged violations may have had on judicial proceedings.” Robinson-Reeder v. Am. Council on Educ., 626 F. Supp. 2d 11, 18 (D.D.C. 2009) (citation modified).

None of OPM's conduct comes close to crossing the line under any of these standards.

Plaintiffs’ first contention—that OPM and its counsel published and submitted the February 5 PIA to moot the motion for a TRO or case, thereby causing Plaintiffs to “undertake the burden and expense of additional legal filings,” Dkt. 31 at 12—is unpersuasive. There was nothing wrong with OPM performing an assessment that Plaintiffs themselves assert was required by law, even if the agency should have performed the assessment earlier and even if it was performed on the eve of a hearing. To the extent Plaintiffs contend that the assessment came too late or was inadequate, those claims go to the merits of the case (which the Court cannot reach without jurisdiction) and do not reflect dishonesty, improper interference with the judicial function, foot dragging, or any other form of malfeasance. To be sure, had OPM waited to prepare and to file the PIA as a form of sandbagging, that might well support a claim for sanctions. But there is no evidence that anything of that kind occurred here.

Plaintiffs’ second basis for seeking sanctions is also unavailing. As noted above, they contend that the February 5 PIA submitted to the Court contained false assertions regarding the voluntariness of responses to GWES emails and that OPM's counsel submitted that PIA without reasonable inquiry. But Plaintiff presents no evidence that OPM or its counsel had any reason to believe that the February 5 PIA was “false” at the time it was submitted. Indeed, Plaintiffs’ own allegations regarding President Trump's and Mr. Musk's social media posts on February 19 and February 22, 2025, see Dkt. 28 at 5–6, suggest that OPM was prompted to change its position regarding the voluntariness of responses to GWES emails after conducting, publishing, and filing the February 5 PIA. Nor do Plaintiffs even contest OPM's counsels’ representations that they were “unaware” of OPM's future plans with the GWES or that the PIA was accurate at the time of filing. See Dkt. 29 at 7–8; Dkt. 31 at 12–13. Although Plaintiffs contend that “[c]ounsel's lack of knowledge as to how their client intended to use GWES nearly two weeks later—even if true—does not show a reasonable prefiling inquiry,”⁵ Dkt. 31 at 13, the Court is unpersuaded that counsel's duty of reasonable inquiry encompasses future plans of this type that may conflict with the agency's stated intentions. Cf. Nat'l Sec. Couns. v. CIA, 960 F. Supp. 2d 101, 137 (D.D.C. 2013) (“It was objectively reasonable for the CIA's counsel to rely on the [CIA's information review officer's] statements, though unfortunately that reliance turned out to be misplaced.”). For similar reasons, the Court is unpersuaded that the conduct of OPM's counsel—who, like Plaintiffs’ counsel and the Court, were operating under unusual time pressure and who were handling multiple emergency matters at the same time—was “reckless” or undertaken in “bad faith.”

In a couple of footnotes, Plaintiffs ask the Court to infer that some official or lawyer, including officials and lawyers in the Department of Justice, OPM, or the Department of Government Efficiency, knew that the February 5 PIA was false on the day it was filed. Dkt. 28 at 9 n.3; Dkt. 31 at 6 n.4 (“[T]he only way that no sanctions would be appropriate would be if not a single lawyer involved in this case and not a single official involved in the drafting of the 1st PIA knew it was false and inaccurate, and proving that is going to require much more evidence than the Opposition that OPM has filed.”). But that flips the burden. If Plaintiffs want the Court to take the extraordinary step of sanctioning lawyers or an agency, they need to prove that the alleged wrongdoing occurred. Plaintiffs fail to identify a single case in which a court has imposed sanctions of the type that they seek—against unnamed, unidentified lawyers and officials from several agencies not before the court—based on speculation that someone must have known that a representation made to the Court was false or misleading.

Plaintiffs’ third and fourth arguments regarding OPM's counsel's purported misrepresentations to the Court are equally meritless. The Court has reviewed OPM's pleadings and the transcripts from both the first and second TRO hearings and has found no misrepresentations—and certainly none that reflected unreasonable, reckless, or bad-faith conduct. OPM's counsel told the Court only that “OPM conducted a PIA and published it on its website,” Dkt. 17-1 at 14; that the February 5 PIA “contain[ed] all of the requisite elements,” Dkt. 19 at 19; and that the February 5 PIA contained the “seven different things” that “[t]he statute requires,” Dkt. 24 at 17. Although Plaintiffs note that OPM's counsel stated that the PIA was “legally sufficient,” Dkt. 31 at 5, the Court did not understand OPM's counsel to be vouching for the substantive accuracy of the February 5 PIA—much less the accuracy of that PIA as applied to future acts. Cf. Gray v. Staley, 310 F.R.D. 32, 39–40 (D.D.C. 2015) (“The statements made by Defendants’ counsel that Plaintiff alleges are false are better characterized as reasonable argument about the Complaint's allegations than objective misstatements of fact. The court does not view them as efforts to mislead it.”). This understanding is reflected in the Court's denial of Plaintiffs’ first TRO motion as moot. That decision was premised entirely on the publication of a PIA that “check[s] each of [the statute's] boxes,” even if Plaintiffs “may think [OPM] ha[s] erred in some respects.” Dkt. 19 at 12.

The same holds for alleged misrepresentations regarding OPM's future plans with GWES and the removal of information belonging to unintended recipients. OPM's counsel repeated several times that she did not “know” whether the unintended recipients had been removed, Dkt. 24 at 19, that she “can't represent ․ with certainty [GWES emails] are not going to anyone they shouldn't,” id., and that she did not “know” what the future plans of GWES were, id. at 22–23. That counsel conveyed that she “believe[d] that filtering has been done to crosscheck who the emails are going to,” id. at 19, did not “le[a]d this Court to believe ․ that once information was identified as belonging to an individual who was not an Executive Branch employee ․, it was removed,” Dkt. 31 at 13. Moreover, for the reasons explained above, it was not unreasonable, reckless, or bad faith for OPM's counsel to make any of the above representations to the Court in reliance on the February 5 PIA or the information they had at the time. Cf. Nat'l Sec. Couns., 960 F. Supp. 2d at 137 (“the conduct on the part of the CIA's counsel was not sanctionable because it appears to have been premised on a reasonable, good-faith belief that the representations were correct at the time.”).

In sum, “[t]he accusations made against [OPM] are devoid of evidentiary support and are largely based upon [P]laintiff[s]’ own mischaracterizations and speculation.” Robinson-Reeder, 626 F. Supp. 2d at 18. Accordingly, the Court finds no basis to impose sanctions upon OPM's counsel or OPM.

D. Motion for Class Certification

Finally, the Court will deny Plaintiffs’ motion for class certification or pre-certification discovery in the alternative, Dkt. 38, as moot. Absent allegations sufficient to establish named class representatives’ standing to sue, Plaintiffs’ class allegations necessarily fail as well. Cf. E. Tex. Motor Freight Sys. Inc. v. Rodriguez, 431 U.S. 395, 403, 97 S.Ct. 1891, 52 L.Ed.2d 453 (1977); see also GCDC LLC v. Sentinel Ins. Co., Ltd., No. 20-cv-1094, 2021 WL 4438908, at *1 (D.D.C. Sept. 28, 2021) (“If a named plaintiff's claims fail as a matter of law, the putative class action complaint should be dismissed in its entirety.”); Brewer v. Holder, No. 08-cv-1747, 2013 WL 12399111, at *2 (D.D.C. Oct. 11, 2013) (“[O]nce a plaintiff's individual claims fail, he cannot be an adequate representative for class claims under Rule 23.”). Because the Court will dismiss Plaintiffs’ Amended Complaint, the Court will deny their motion to certify a class as moot.

CONCLUSION

For the foregoing reasons, the Court will GRANT Defendant's motion to dismiss, Dkt. 17, and will DISMISS the Amended Complaint, Dkt. 14, without prejudice. In addition, the Court will DENY Plaintiffs’ motion for sanctions, Dkt. 28, and DENY Plaintiffs’ motion to certify a class, Dkt. 38, as moot.

A separate order will issue.

FOOTNOTES

1.   Plaintiffs contend that Hogan may be a “Special Government Employee[ ]” and not a “full-time OPM employee[ ].” Dkt. 14 at 9 (Am. Compl. ¶ 38). They further contend that Hogan was not an “OPM employee[ ] prior to 20 January.” Id. at 9 (Am. Compl. ¶ 39). To the extent that Plaintiffs characterize OPM's procedural violation as Hogan's improper employment status or duration, this cannot be inferred from any of Plaintiffs’ allegations, and Plaintiffs point to no part of the E-Government Act or the OMB Guidance that requires the Reviewing Official to be a full-time OPM employee or to be employed for a particular duration prior to the issuance of the PIA.

2.   Plaintiffs might, at least in theory, contend that if OPM had prepared a PIA before implementing the GWES it might have focused on the fact that not every .gov or .mil email address is associated with an executive branch employee or officer and might have found a way to omit non-executive branch employees or officers from the database. As a remedy, Plaintiffs might, at least in theory, then seek an order removing these email addresses from the database, pending the preparation of a further PIA. But that claim appears nowhere in Plaintiffs’ Amended Complaint, which is all that matters for present purposes. For this reason, and because Plaintiffs’ standing further falters at the next step, the Court expresses no view on whether such a theory would suffice to satisfy the first causal step.

3.   In their opposition brief, Plaintiffs add yet another news article that purports to “support” their analysis. See Dkt. 30 at 3 n.3 (citing Doge Exposes Once-Secret Government Networks, Making Cyber-Espionage Easier than Ever, Substack: Cyber-Intelligence Brief (Feb. 9, 2025)), https://perma.cc/WGD2-GD6B. “[A] complaint may not be amended by the briefs in opposition to a motion to dismiss.” Chin-Teh Hsu v. New Mighty U.S. Tr., No. 10-cv-1743, 2020 WL 588322, at *8 (D.D.C. Feb. 6, 2020) (quoting Hajjar-Nejad v. George Washington Univ., 802 F. Supp. 2d 166, 175 (D.D.C. 2011)). Even if the Court could consider new allegations raised in Plaintiffs’ opposition briefing, this article would do little to help Plaintiffs’ standing to bring suit, as it makes no reference to OPM, its servers, or the GWES.

4.   Plaintiffs complied with the requisite procedure to move for Rule 11 sanctions. Pursuant to Rule 11(c)(2), a motion for sanctions “must be served under Rule 5, but it must not be filed or be presented to the court if the challenged paper, claim, defense, contention, or denial is withdrawn or appropriately corrected within 21 days after service.” Fed. R. Civ. P. 11(c)(2). On February 24, 2025, Plaintiffs moved to shorten the safe harbor period, see Dkt. 23, and Defendant indicated that it did not oppose the motion, Dkt. 25. This Court granted Plaintiffs’ motion to shorten the safe harbor period, see Min. Order (Feb. 26, 2025), and instructed Plaintiffs that they “may file or present the relevant motion to the Court after 6:00 p.m. on Friday, February 28, 2025,” id.

5.   The Court notes that all of the facts related to the voluntariness of responses to GWES emails contained in Plaintiffs’ motion for sanctions post-date the February 5 PIA, and the Court was unable to find any “indicia” that responses to GWES emails were not voluntary in Plaintiffs’ Amended Complaint. Dkt. 31 at 13.

RANDOLPH D. MOSS, United States District Judge