U.S. Office of Pers. Mgmt. Data SEC. Breach Litig. v. Office of Pers. Mgmt.

United States Court of Appeals

FOR THE DISTRICT OF COLUMBIA CIRCUIT

Argued November 2, 2018 Decided June 21, 2019

No. 17-5217

IN RE: U.S. OFFICE OF PERSONNEL MANAGEMENT DATA

SECURITY BREACH LITIGATION,

AMERICAN FEDERATION OF GOVERNMENT EMPLOYEES,

AFL-CIO, ET AL.,

APPELLEES

NATIONAL TREASURY EMPLOYEES UNION, ET AL.,

APPELLANTS

v.

OFFICE OF PERSONNEL MANAGEMENT, ET AL.,

APPELLEES

Consolidated with 17-5232

Appeals from the United States District Court

for the District of Columbia

(No. 1:15-mc-01394)

Peter A. Patterson argued the cause for Arnold Plaintiffs-

Appellants in No. 17-5232. With him on the briefs were David

H. Thompson, Daniel C. Girard, Jordan Elias, Tina Wolfson,

Gary E. Mason, and Richard B. Rosenthal.

2

Paras N. Shah argued the cause for appellants National

Treasury Employees Union, et al. in No. 17-5217. With him

on the briefs were Gregory O=Duden, Larry J. Adkins, and

Allison C. Giles.

Marc Rotenberg and Alan Butler were on the brief for

amici curiae Electronic Privacy Information Center (EPIC) and

Forty-Four Legal Scholars and Technical Experts in support of

appellants.

Sonia M. Carson, Attorney, U.S. Department of Justice,

argued the cause for federal appellees. With her on the brief

was Mark B. Stern.

Jason J. Mendro argued the cause for appellee KeyPoint

Government Solutions, Inc. With him on the brief were F.

Joseph Warin, Matthew S. Rozen, and Jeremy M. Christiansen.

Alan Charles Raul, Kwaku A. Akowuah, Daniel J. Hay,

and Steven P. Lehotsky were on the brief for amicus curiae The

Chamber of Commerce of the United States of America in

support of appellees.

Before: TATEL and MILLETT, Circuit Judges, and

WILLIAMS, Senior Circuit Judge.

Opinion for the Court filed PER CURIAM.

Opinion concurring in part and dissenting in part filed by

Senior Circuit Judge WILLIAMS.

PER CURIAM: In 2014, cyberattackers breached multiple

U.S. Office of Personnel Management (“OPM”) databases and

allegedly stole the sensitive personal information—including

3

birth dates, Social Security numbers, addresses, and even

fingerprint records—of a staggering number of past, present,

and prospective government workers. All told, the data

breaches affected more than twenty-one million people.

Unsurprisingly, given the scale of the attacks and the sensitive

nature of the information stolen, news of the breaches

generated not only widespread alarm, but also several lawsuits.

These suits were ultimately consolidated into two complaints:

one filed by the National Treasury Employees Union and three

of its members, and another filed by the American Federation

of Government Employees on behalf of several individual

plaintiffs and a putative class of others similarly affected by the

breaches. Both sets of plaintiffs alleged that OPM’s

cybersecurity practices were woefully inadequate, enabling the

hackers to gain access to the agency’s treasure trove of

employee information, which in turn exposed plaintiffs to a

heightened risk of identity theft and a host of other injuries.

The district court dismissed both complaints for lack of Article

III standing and failure to state a claim. For the reasons set

forth below, we reverse in part and affirm in part.

I

As its name suggests, the U.S. Office of Personnel

Management serves as the federal government’s chief human

resources agency. In that capacity, OPM maintains electronic

personnel files that contain, among other information, copies

of federal employees’ birth certificates, military service

records, and job applications identifying Social Security

numbers and birth dates.

The agency also oversees more than two million

background checks and security clearance investigations per

year. To facilitate these investigations, OPM collects a

tremendous amount of sensitive personal information from

current and prospective federal workers, most of which it then

4

stores electronically in a “Central Verification System.”

Consolidated Amended Complaint, In re United States Office

of Pers. Mgmt. Data Security Breach Litig., No. 1:15-mc-

01394, ¶ 65 (D.D.C. March 14, 2016) (“Arnold Plaintiffs’

Compl.”), J.A. 61. The investigation-related information

stored by OPM includes birth dates, Social Security numbers,

residency details, passport information, fingerprints, and other

records pertaining to employees’ criminal histories,

psychological and emotional health, and finances. In recent

years, OPM has relied on a private investigation and security

firm, KeyPoint Government Solutions, Inc. (“KeyPoint”), to

conduct the lion’s share of the agency’s background and

security clearance investigation fieldwork. KeyPoint

investigators have access to the information stored in OPM’s

Central Verification System and can transmit data to and from

the agency’s network through an electronic portal.

It turns out that authorized KeyPoint investigators have not

been the only third parties to access OPM’s data systems.

Cyberattackers hacked into the agency’s network on several

occasions between November 2013 and November 2014.

Undetected for months, at least two of these breaches resulted

in the theft of vast quantities of personal information.

According to the complaint, after breaching OPM’s network

“using stolen KeyPoint credentials” around May 2014, Arnold

Plaintiffs’ Compl. ¶ 127, J.A. 73, the cyberintruders extracted

almost 21.5 million background investigation records from the

agency’s Central Verification System. They gained access to

another OPM system near the end of 2014, stealing over four

million federal employees’ personnel files. Among the types

of information compromised were current and prospective

employees’ Social Security numbers, birth dates, and residency

details, along with approximately 5.6 million sets of

fingerprints. The breaches also exposed the Social Security

numbers and birth dates of the spouses and cohabitants of those

5

who, in order to obtain a security clearance, completed a

Standard Form 86. According to the complaints, since these

2014 breaches, individuals whose information was stolen have

experienced incidents of financial fraud and identity theft;

many others whose information has not been misused—at

least, not yet—remain concerned about the ongoing risk that

they, too, will become victims of financial fraud and identity

theft in the future.

After announcing the breaches in the summer of 2015,

OPM initially offered individuals whose information had been

compromised fraud monitoring and identity theft protection

services and insurance at no cost for either eighteen months or

three years, depending on whether their Social Security

numbers had been exposed. But OPM’s offer failed to address

the concerns of all such parties, and the agency soon found

itself named as a defendant in breach-related lawsuits across

the country. The Judicial Panel on Multidistrict Litigation

transferred these actions to the U.S. District Court for the

District of Columbia for coordinated pretrial proceedings. The

suits were ultimately consolidated into two complaints: one

brought by the American Federation of Government

Employees on behalf of thirty-eight individuals affected by the

breaches and a putative class of similarly situated breach

victims (“Arnold Plaintiffs”) and another for declaratory and

injunctive relief brought by the National Treasury Employees

Union (“NTEU”) and three of its members (“NTEU

Plaintiffs”). Below we summarize the relevant allegations and

claims contained in each complaint, accepting all factual

allegations “as true” and drawing “reasonable

inferences * * * in the plaintiffs’ favor.” Philipp v. Federal

Republic of Germany, 894 F.3d 406, 409 (D.C. Cir. 2018)

(internal quotation marks omitted).

6

Arnold Plaintiffs allege that KeyPoint’s “information

security defenses did not conform to recognized industry

standards” and that the company unreasonably failed to protect

the security credentials that the hackers used to unlawfully

access one of OPM’s systems in mid-2014. Arnold Plaintiffs’

Compl. ¶ 222, J.A. 98. Specifically, they assert that “KeyPoint

knew or should have known that its information security

defenses did not reasonably or effectively protect Plaintiffs’

and Class members’ [personal information] and the credentials

used to access it on KeyPoint’s and OPM’s systems.” Id. As

for OPM, Arnold Plaintiffs allege that the agency had long

been on notice that its systems were prime targets for

cyberattackers. OPM experienced data breaches related to

cyberattacks in 2009 and 2012, and it is no secret that its

network is regularly subject to a strikingly large number of

hacking attempts. Despite this, say Arnold Plaintiffs, OPM

repeatedly failed to comply with the Federal Information

Security Management Act of 2002, 44 U.S.C. §§ 3541 et seq.

(repealed 2014), and its replacement, the Federal Information

Security Modernization Act of 2014, 44 U.S.C. §§ 3551 et seq.

(collectively, “Information Security Act”), which require

agencies to “develop, implement, and maintain a security

program that assesses information security risks and provides

adequate security for the operations and assets of programs and

software systems under agency and contractor control.”

Arnold Plaintiffs’ Compl. ¶ 83, J.A. 65.

As early as 2007, Information Security Act compliance

audits conducted by OPM’s Office of the Inspector General

regularly identified major information security deficiencies

that left the agency’s network vulnerable to attack. Such

problems included “severely outdated” security policies and

procedures, understaffed and undertrained cybersecurity

personnel, and a lack of a centralized information security

management structure. Arnold Plaintiffs’ Compl. ¶¶ 92–95,

7

J.A. 67–68. As a result, in every year from 2007 through 2013,

the Inspector General identified “serious concerns

that * * * pose an immediate risk to the security of assets or

operations”—termed “material weaknesses”—in the agency’s

information security governance program. Id. ¶¶ 87–88, J.A.

66; see also id. ¶¶ 90–97, J.A. 66–68 (listing those

weaknesses). Although in 2014 the Inspector General, acting

on the basis of “imminently planned improvements,” id. ¶ 98,

J.A. 68, reclassified OPM’s security governance program as a

“significant deficiency” (an improvement over the more

serious “material weakness”), other serious issues resurfaced at

that time. Specifically, in 2014, the agency failed to complete

an Information Security Act-required Security Assessment and

Authorization for eleven of the twenty-one OPM systems due

for reauthorization. Because the agency was unable to ensure

the functionality of security controls for the systems that lacked

a valid authorization—one of which was “a general system that

supported and provided the electronic platform for

approximately two-thirds of all information systems operated

by OPM”—the Inspector General advised the agency to shut

them down. Id. ¶¶ 102–103, J.A. 69–70. Despite the Inspector

General’s recommendation, OPM continued to operate the

systems. The agency compounded existing security

vulnerabilities by failing to encrypt sensitive data—including

Social Security numbers—and failing to enforce multifactor

authentication requirements. To make matters worse, when the

2014 data breaches occurred, the agency lacked a centralized

network security operations center from which it could

continuously and comprehensively monitor all system security

controls and threats.

The 2014 cyberattacks were “sophisticated, malicious, and

carried out to obtain sensitive information for improper use.”

Arnold Plaintiffs’ Compl. ¶¶ 128, 132, J.A. 73–74. Arnold

Plaintiffs assert that as a result of these attacks, they have

8

suffered from a variety of harms, including the improper use of

their Social Security numbers, unauthorized charges to existing

credit card and bank accounts, fraudulent openings of new

credit card and other financial accounts, and the filing of

fraudulent tax returns in their names. At least three named

Arnold Plaintiffs purchased credit monitoring services after

falling victim to such fraud; others have spent time and money

attempting to unwind fraudulent transactions made in their

names. And some Arnold Plaintiffs who have yet to experience

a fraud incident purchased credit monitoring services and spent

extra time monitoring their accounts to mitigate the “increased

risk” of identity theft caused by the breaches. Id. ¶ 163, J.A.

81–83.

Arnold Plaintiffs assert several claims against OPM, but

they press only one on appeal: that the agency “willfully

failed” to establish appropriate safeguards to ensure the

security and confidentiality of their private information, in

violation of Section 552a(e)(10) of the Privacy Act of 1974.

Arnold Plaintiffs’ Compl. ¶ 182, J.A. 89; see also 5 U.S.C.

§ 552a(e)(10) (requiring the agency to “establish appropriate

administrative, technical, and physical safeguards to insure the

security and confidentiality of records and to protect against

any anticipated threats or hazards to their security or integrity

which could result in substantial harm, embarrassment,

inconvenience, or unfairness to any individual on whom

information is maintained”). They also bring a variety of

common-law and statutory claims against KeyPoint, alleging

that the company’s “actions and inactions constitute[d]

negligence, negligent misrepresentation and concealment,

invasion of privacy, breach of contract, and violations of the

Fair Credit Reporting Act and state statutes.” Arnold

Plaintiffs’ Compl. ¶ 9, J.A. 38. Arnold Plaintiffs seek damages

from OPM under the Privacy Act; from KeyPoint, they request

money damages and an order requiring the company to extend

9

free lifetime identity theft and fraud protection services to all

putative class members, among other things.

The other complaint, filed by the National Treasury

Employees Union, seeks declaratory and injunctive relief

against the Acting Director of OPM in her official capacity

based on essentially the same set of facts. NTEU Plaintiffs

assert that when they provided OPM with the sensitive personal

information ultimately exposed in the breaches, they did so

upon the agency’s assurance that it “would be safeguarded”

and kept confidential. Amended Complaint for Declaratory

and Injunctive Relief, In re United States Office of Pers. Mgmt.

Data Security Breach Litig., No. 1:15-mc-01394, ¶ 75 (D.D.C.

June 3, 2016) (“NTEU Plaintiffs’ Compl.”), J.A. 179. They

allege that OPM’s “reckless failure to safeguard [NTEU

Plaintiffs’] personal information,” which ultimately “resulted

in [its] unauthorized disclosure” during the 2014 attacks, id. at

3, J.A. 155, amounted to a violation of what they describe as

their “constitutional right to informational privacy,” id. ¶ 98,

J.A. 186.

NTEU Plaintiffs further allege that, despite the fallout

from the 2014 breaches, OPM has yet to make the

cybersecurity improvements necessary to protect their personal

information from future attacks. According to the complaint,

the agency’s Inspector General warned at the end of 2015 that

OPM was ill-equipped to protect itself from another attack,

given “the overall lack of compliance that seems to permeate

the agency’s IT security program.” NTEU Plaintiffs’ Compl.

¶ 88, J.A. 182 (quoting United States Office of Pers. Mgmt.,

Office of the Inspector General, Office of Audits, Final Audit

Report: Federal Information Security Modernization Act Audit

FY 2015, at 5 (Nov. 10, 2015)). NTEU Plaintiffs seek a

declaration that OPM’s failure to protect their information

violated their putative constitutional right to informational

10

privacy and an order requiring the agency to provide them with

free lifetime credit monitoring and identity theft protection.

They also request an injunction requiring OPM “to take

immediately all necessary and appropriate steps to correct

deficiencies in [its] IT security program so that NTEU

members’ personal information will be protected from

unauthorized disclosure” in the future. Id. at 35, J.A. 187.

OPM and KeyPoint moved to dismiss Arnold Plaintiffs’

complaint, arguing that they lacked Article III standing, that

their claims were barred by sovereign immunity, and that they

failed to state valid claims under the state and federal statutes

and common-law theories invoked. OPM moved to dismiss

NTEU Plaintiffs’ complaint for lack of standing and failure to

state a claim upon which relief could be granted—that is,

failure to allege a cognizable constitutional violation. The

district court granted both motions to dismiss on the ground

that neither Arnold Plaintiffs nor NTEU Plaintiffs pled

sufficient facts to demonstrate Article III standing. Rejecting

plaintiffs’ argument that they faced a heightened risk of

identity theft due to the breaches, the court held that the facts

alleged failed to plausibly support the conclusion that this risk

of future injury was either substantial or clearly impending.

The district court ultimately concluded that only those

plaintiffs who specifically identified out-of-pocket losses

stemming from the actual misuse of their data had suffered an

injury in fact sufficient for standing purposes. But even those

plaintiffs lacked standing, the district court concluded, because

they failed to allege facts demonstrating that the misuse of their

information was traceable to the OPM breaches in particular.

The district court went on to explain that it also lacked

subject matter jurisdiction over Arnold Plaintiffs’ claims for

the additional reasons that (i) they failed to plead the actual

damages necessary to bring them within the Privacy Act’s

11

waiver of sovereign immunity; and (ii) as a government

contractor, KeyPoint enjoyed derivative sovereign immunity

from suit. Finally, the court concluded that Arnold Plaintiffs

failed to plausibly allege a Privacy Act claim and that NTEU

Plaintiffs’ complaint failed to state a constitutional claim. Both

sets of plaintiffs have appealed.

We reverse in part and affirm in part the district court’s

judgment. We hold that both sets of plaintiffs have alleged

facts sufficient to satisfy Article III standing requirements.

Arnold Plaintiffs have stated a claim for damages under the

Privacy Act, and have unlocked OPM’s waiver of sovereign

immunity, by alleging OPM’s knowing refusal to establish

appropriate information security safeguards. KeyPoint is not

entitled to derivative sovereign immunity because it has not

shown that its alleged security faults were directed by the

government, and it is alleged to have violated the Privacy Act

standards incorporated into its contract with OPM. Finally, we

agree with the district court that, assuming a constitutional right

to informational privacy, NTEU Plaintiffs have not alleged any

violation of such a right.

II

“[T]he irreducible constitutional minimum of standing

consists of three elements.” Spokeo, Inc. v. Robins, 136 S. Ct.

1540, 1547 (2016) (internal quotation marks omitted). First,

plaintiffs must demonstrate that they suffered an injury in fact

that is “concrete and particularized and actual or imminent, not

conjectural or hypothetical.” Id. at 1548 (internal quotation

marks omitted). “An allegation of future injury” passes Article

III muster only if it “is ‘certainly impending,’ or there is a

‘substantial risk’ that the harm will occur.” Susan B. Anthony

List v. Driehaus, 573 U.S. 149, 158 (2014) (quoting Clapper v.

Amnesty Int’l USA, 568 U.S. 398, 414 & n.5 (2013)). Second,

plaintiffs must demonstrate causation; that is, they must show

12

that their claimed injury is “fairly traceable to the challenged

conduct of the defendant.” Spokeo, 136 S. Ct. at 1547. “Article

III standing does not require that the defendant be the most

immediate cause, or even a proximate cause, of the plaintiffs’

injuries; it requires only that those injuries be ‘fairly traceable’

to the defendant.” Attias v. Carefirst, Inc., 865 F.3d 620, 629

(D.C. Cir. 2017), cert. denied, 138 S. Ct. 981 (2018). And

third, plaintiffs must demonstrate that “it is likely, as opposed

to merely speculative, that the[ir] injury will be redressed by a

favorable decision.” Friends of the Earth, Inc. v. Laidlaw

Environmental Servs. (TOC), Inc., 528 U.S. 167, 181 (2000).

Where, as here, defendants challenge standing at the

pleading stage without disputing the facts alleged in the

complaint, “we accept the well-pleaded factual allegations as

true and draw all reasonable inferences from those allegations

in the plaintiff’s favor,” but we do not assume the truth of legal

conclusions or accept inferences that are unsupported by the

facts alleged in the complaint. Arpaio v. Obama, 797 F.3d 11,

19 (D.C. Cir. 2015). “We review de novo the district court’s

dismissal for lack of standing.” Id. The question at this early

juncture in the litigation is whether plaintiffs have plausibly

alleged standing. Contrary to the district court’s ruling,

plaintiffs need not yet establish each element of standing by a

preponderance of the evidence. See Lujan v. Defenders of

Wildlife, 504 U.S. 555, 561 (1992) (“[E]ach element [of

standing] must be supported in the same way as any other

matter on which the plaintiff bears the burden of proof, i.e.,

with the manner and degree of evidence required at the

successive stages of the litigation.”).

A

We begin with NTEU Plaintiffs. For standing purposes,

we assume that NTEU Plaintiffs have, as they claim, a

“constitutional right to informational privacy” that was

13

violated “the moment that [cyberattackers stole] their

inherently personal information * * * from OPM’s deficiently

secured databases.” NTEU Br. 11; see also Estate of Boyland

v. Department of Agric., 913 F.3d 117, 123 (D.C. Cir. 2019)

(“[W]hen considering whether a plaintiff has Article III

standing, a federal court must assume, arguendo, the merits of

his or her legal claim.”) (internal quotation marks omitted).

Furthermore, given NTEU Plaintiffs’ allegations regarding

OPM’s continued failure to adequately secure its databases, it

is reasonable to infer that there remains a “substantial risk” that

their personal information will be stolen from OPM again in

the future. NTEU Plaintiffs’ Compl. ¶ 88, J.A. 182. With

respect to this claim, the loss of a constitutionally protected

privacy interest itself would qualify as a concrete,

particularized, and actual injury in fact. And the ongoing and

substantial threat to that privacy interest would be a concrete,

particularized, and imminent injury in fact. Both claimed

injuries are plausibly traceable to OPM’s challenged conduct,

and the latter is redressable either by a declaration that the

agency’s failure to protect NTEU Plaintiffs’ personal

information is unconstitutional or by an order requiring OPM

to immediately correct deficiencies in its cybersecurity

programs. Cf. ACLU v. Clapper, 785 F.3d 787, 801 (2d Cir.

2015) (holding that, where plaintiffs allege a Fourth

Amendment “injury [stemming] from the very collection of

their telephone metadata,” they “have suffered a concrete and

particularized injury fairly traceable to the challenged program

and redressable by a favorable ruling”). Accordingly, NTEU

Plaintiffs have standing based on their claimed constitutional

injury.

B

Arnold Plaintiffs allege no such constitutional injury, but

they do claim to have suffered a variety of past and future data-

breach related harms. See, e.g., Arnold Plaintiffs’ Compl. ¶ 22,

14

J.A. 44–45 (alleging that Plaintiff Jane Doe has “suffer[ed]

stress resulting from concerns for her personal safety and that

of her family members” since being informed by the FBI that

her personal information “had been acquired by the so-called

Islamic State of Iraq and al-Sham (‘ISIS’)”). For purposes of

our standing analysis, we focus on one injury they all share:

the risk of future identity theft. As we have already recognized,

“identity theft * * * constitute[s] a concrete and particularized

injury.” Attias, 865 F.3d at 627; see also Hancock v. Urban

Outfitters, Inc., 830 F.3d 511, 514 (D.C. Cir. 2016) (offering

the “increased risk of fraud or identity theft” as an “example”

of a “concrete consequence” for standing purposes). Yet, the

district court concluded that Arnold Plaintiffs’ complaint

provided an insufficient basis from which to infer that, in the

wake of the OPM breaches, Arnold Plaintiffs faced any

meaningful risk of future identity theft, much less a

“substantial” one. In re United States Office of Pers. Mgmt.

Data Security Breach Litig. (“In re OPM”), 266 F. Supp. 3d 1,

35 (D.D.C. 2017). Furthermore, finding that “the risk of

identity theft was neither clearly impending nor substantial,”

the district court concluded that any expenses that Arnold

Plaintiffs incurred attempting to mitigate that risk likewise

failed to qualify as an Article III injury in fact. Id. at 36; see

also Clapper, 568 U.S. at 416 (“[R]espondents cannot

manufacture standing merely by inflicting harm on themselves

based on their fears of hypothetical future harm that is not

certainly impending.”).

Arnold Plaintiffs argue that the district court’s conclusion

is incompatible with our decision in Attias v. CareFirst. In that

case, we determined that the victims of a cyberattack on

CareFirst, a health insurance company, “cleared the low bar to

establish their standing at the pleading stage” by plausibly

alleging that they faced a substantial risk of identity theft as a

result of the company’s negligent failure to thwart the attack.

15

Attias, 865 F.3d at 622. Specifically, the complaint alleged that

the breach exposed “all of the information wrongdoers need for

appropriation of a victim’s identity”: personal identification

information, credit card numbers, and Social Security numbers.

Id. at 628 (internal quotation marks omitted). Based largely on

the nature of the information compromised in the attack, we

concluded that it was reasonable to infer that the cyberattackers

had “both the intent and the ability to use that data for ill.” Id.;

see also id. at 628–629 (“Why else would hackers break into

a * * * database and steal consumers’ private information?

Presumably, the purpose of the hack is, sooner or later, to make

fraudulent charges or assume those consumers’ identities.”)

(quoting Remijas v. Neiman Marcus Grp., 794 F.3d 688, 693

(7th Cir. 2015)). Accordingly, we explained, “[n]o long

sequence of uncertain contingencies involving multiple

independent actors has to occur before the plaintiffs in this case

will suffer any harm; a substantial risk of harm exists already,

simply by virtue of the hack and the nature of the data that the

plaintiffs allege was taken.” Id. at 629.

Although the OPM cyberattacks differ in several respects

from the breach at issue in Attias, there is no question that the

OPM hackers, too, now have in their possession all the

information needed to steal Arnold Plaintiffs’ identities.

Arnold Plaintiffs have alleged that the hackers stole Social

Security numbers, birth dates, fingerprints, and addresses,

among other sensitive personal information. It hardly takes a

criminal mastermind to imagine how such information could

be used to commit identity theft. Indeed, several Arnold

Plaintiffs claim that they have already experienced various

types of identity theft, including the unauthorized opening of

new credit card and other financial accounts and the filing of

fraudulent tax returns in their names. Moreover, unlike

existing credit card numbers, which, if compromised, can be

changed to prevent future fraud, Social Security numbers and

16

addresses cannot so readily be swapped out for new ones. And,

of course, our birth dates and fingerprints are with us forever.

Viewing the allegations in the light most favorable to Arnold

Plaintiffs, as we must, we conclude that not only do the

incidents of identity theft that have already occurred illustrate

the nefarious uses to which the stolen information may be put,

but they also support the inference that Arnold Plaintiffs face a

substantial—as opposed to a merely speculative or

theoretical—risk of future identity theft.

It is worth noting that several Arnold Plaintiffs also allege

that unauthorized charges have appeared on their existing

credit card and bank account statements since the breaches.

According to OPM, because none of these Arnold Plaintiffs

“specifically alleged the OPM incidents affected their existing

account information,” the reported incidents of fraud on

existing accounts (and, presumably, the risk of future fraud on

those accounts) cannot plausibly be attributed to the OPM

breaches. Gov’t Br. 21. But we need not travel down that road

because, regardless of whether the hackers obtained all the

information necessary to make unauthorized charges to

existing accounts, it is undisputed that the other forms of fraud

alleged—the opening of new accounts and the filing of

fraudulent tax returns—may be accomplished using the

information stolen during the breaches at issue.

OPM argues that Arnold Plaintiffs’ allegations of

“scattered instances of widely varying fraud” are insufficient

to support a plausible inference that Arnold Plaintiffs face an

ongoing, substantial risk of identity theft. Gov’t Br. 20.

Specifically, OPM contends that despite the sensitive nature of

the information stolen in the attacks, “[i]t is impossible under

these circumstances to ‘easily construct any kind of colorable

theory’ that a desire to commit fraud motivated” the OPM

breaches. Id. at 21 (quoting In re OPM, 266 F. Supp. 3d at 38).

17

This is especially the case, OPM argues, because “this is not

just a data breach,” but rather “a data breach arising out of a

particular sort of cyberattack” against the United States. Id. at

23 (quoting In re OPM, 266 F. Supp. 3d at 9). According to

OPM, it is illogical to assume that the same goals that typically

motivate hackers of commercial databases animated the

“sophisticated” actors who engineered these data breaches. Id.

at 27. The district court agreed with OPM on this point.

Although neither amended complaint contains any allegations

regarding the cyberattackers’ identity, the court noted that

news articles and congressional reports had suggested that the

suspected perpetrator was not a common criminal, but rather

the Chinese government. Despite acknowledging that “a

finding concerning the source of the breach” was “beyond the

scope of [the] proceeding at this juncture,” the court appears to

have relied at least partially on this external information in

reaching the conclusion that it was implausible that the OPM

hackers intended to steal Arnold Plaintiffs’ identities. In re

OPM, 266 F. Supp. 3d at 34.

As an initial matter, the district court should not have

relied even in part on its own surmise that the Chinese

government perpetrated these attacks. Absent any factual

allegations regarding the identity of the cyberattackers, the

district court was not free to conduct its own extra-record

research and then draw inferences from that research in OPM’s

and KeyPoint’s favor. See Arpaio, 797 F.3d at 19 (explaining

that where the defendant challenges the plaintiff’s standing at

the motion-to-dismiss stage, we “draw all reasonable

inferences * * * in the plaintiff’s favor”). Beyond that,

although a cyberattack on a government system might well be

motivated by a purpose other than identity theft, given the type

of information stolen in the OPM breaches and Arnold

Plaintiffs’ allegations regarding the subsequent misuse of that

information, it is just as plausible to infer that identity theft is

18

at least one of the hackers’ goals, even if those hackers are

indeed affiliated with a foreign government.

Our dissenting colleague takes a different tack, suggesting

that because this case involves government databases,

“espionage * * * is * * * an ‘obvious alternative explanation’”

for the attacks. See Dissenting Op. at 4 (quoting Ashcroft v.

Iqbal, 556 U.S. 662, 682 (2009)). We disagree as to just how

obvious an explanation this is based on the facts alleged in the

complaint. Furthermore, given that espionage and identity

theft are not mutually exclusive, the likely existence of an

espionage-related motive hardly renders implausible Arnold

Plaintiffs’ claim that they face a substantial future risk of

identity theft and financial fraud as a result of the breaches.

See, e.g., Watson Carpet & Floor Covering, Inc. v. Mohawk

Indus., Inc., 648 F.3d 452, 458 (6th Cir. 2011) (“Ferreting out

the most likely reason for the defendants’ actions is not

appropriate at the pleadings stage * * * . [T]he plausibility of

[one particular] reason for the refusals to sell carpet does not

render all other reasons implausible.”). By contrast, in the

cases cited by the dissent, the obvious alternative explanations

were necessarily incompatible with the plaintiffs’ versions of

events. See Iqbal, 556 U.S. at 682 (rejecting claims of

invidious discrimination as implausible where there existed an

obvious, nondiscriminatory law enforcement justification for

the challenged acts); Bell Atl. Corp. v. Twombly, 550 U.S. 544,

567–568 (2007) (rejecting a conspiracy claim as implausible

where history and market forces provided “a natural

explanation” for the defendants’ behavior).

In any case, although we found in Attias that the

circumstances of that breach made it at least plausible that the

hackers there had “both the intent and the ability to use [the

plaintiffs’] data for ill,” 865 F.3d at 628, a hacker’s “intent” to

use breach victims’ personal data for identity theft becomes

19

markedly less important where, as here, several victims allege

that they have already suffered identity theft and fraud as a

result of the breaches. When considered in combination with

the obvious potential for fraud presented by the information

stolen during the breaches, the fact that certain Arnold

Plaintiffs have already had fraudulent accounts opened and tax

returns filed in their names moves the risk of future identity

theft across the line from speculative to substantial, at least at

this early stage in the proceedings. See id. at 625 (explaining

that at the pleading stage, “plaintiffs are required only to state

a plausible claim that each of the standing elements is present”)

(internal quotation marks omitted).

The circumstances here differ markedly from those in the

two cases OPM cites in support of its argument that Arnold

Plaintiffs’ risk of future identity theft is merely conjectural. In

Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017), a laptop

containing patients’ unencrypted personal information,

“including names, birth dates, the last four digits of social

security numbers, and physical descriptors,” and four boxes of

medical records that contained names and Social Security

numbers went missing from a Veterans Affairs medical center.

Id. at 267–269. The Fourth Circuit held that the risk of future

identity theft stemming from the incidents was too speculative

to satisfy the injury-in-fact requirement because the plaintiffs

failed to allege either (i) that the thief “intentionally targeted”

the personal information contained in the laptop and boxes or

(ii) that the thief subsequently used that information to commit

identity theft. Id. at 274–275 (“[E]ven after extensive

discovery, the * * * plaintiffs [who sued over the theft of the

laptop] have uncovered no evidence that the information

contained on the stolen laptop has been accessed or misused or

that they have suffered identity theft, nor, for that matter, that

the thief stole the laptop with the intent to steal their private

information.”); id. at 275 (“Watson’s complaint suffers from

20

the same deficiency with regard to the four missing boxes of

pathology reports.”). Without such allegations, the Fourth

Circuit explained, there was nothing to “push the threatened

injury of future identity theft beyond the speculative to the

sufficiently imminent.” Id. at 274.

In the other case, Reilly v. Ceridian Corp., 664 F.3d 38 (3d

Cir. 2011), an unknown hacker infiltrated a payroll processing

firm’s database, “potentially” gaining access to employees’

“personal and financial information.” Id. at 40. It was “not

known whether the hacker read, copied, or understood the

data,” id., and none of the affected parties alleged that their data

had since been misused, id. at 44 (“Appellants have alleged no

misuse.”). Because the plaintiffs’ claimed risk of future

identity theft therefore rested solely on “hypothetical

speculations concerning the possibility of future injury,” the

Third Circuit held that the risk was insufficient to support

standing. Id. at 43.

Here, in contrast to those two cases, Arnold Plaintiffs both

allege that the OPM cyberattackers intentionally targeted their

information and point out the subsequent misuse of that

information. See Arnold Plaintiffs’ Compl. ¶¶ 128, 130, J.A.

73–74 (alleging that the hackers targeted—and extracted data

from—the agency’s “Electronic Official Personnel Folder

system” and the database used to collect background check

information); see, e.g., id. ¶¶ 21–22, 24, 26, J.A. 44–48

(alleging incidents involving misuse of information). These

are precisely the types of allegations missing in Beck and

Reilly. See Beck, 848 F.3d at 275 (“[T]he mere theft of these

items, without more, cannot confer Article III standing.”)

(emphasis added); Reilly, 664 F.3d at 44 (“Here, there is no

evidence that the intrusion was intentional or malicious.

Appellants have alleged no misuse * * * . Indeed, no

21

identifiable taking occurred; all that is known is that a firewall

was penetrated.”).

Although it is true, as a general principle, that

“‘as * * * breaches fade further into the past,’ * * * threatened

injuries become more and more speculative,” we are

unpersuaded by the dissent’s suggestion that the passage of less

than two years between these particular attacks and Arnold

Plaintiffs’ filing of the operative complaint is enough to render

the threat of future harm insubstantial. Dissenting Op. at 7

(quoting Beck, 848 F.3d at 275). The plaintiffs in Beck suffered

no misuse of their data prior to filing their complaint. See supra

at 19–20. And the same was true of the plaintiffs in Chambliss

v. Carefirst, Inc., 189 F. Supp. 3d 564 (D. Md. 2016), the case

cited by the dissent and the court in Beck for the proposition

that the threat of future injury diminishes over time. See id. at

570 (noting that plaintiffs had not experienced “any misuse” of

their data prior to filing their complaint). Although the passage

of two years in a run-of-the-mill data breach case might, absent

allegations of subsequent data misuse, suggest that a claim of

future injury is less than plausible, that is not the situation we

face here. Conducted over several months by sophisticated and

apparently quite patient cyberhackers, the attacks at issue in

this case affected over twenty-one million people and involved

information far more sensitive than credit card numbers.

Cyberhacking on such a massive scale is a relatively new

phenomenon, and we are unwilling at this stage to assume that

the passage of a year or two without any clearly identifiable

pattern of identity theft or financial fraud means that all those

whose data was compromised are in the clear.

Drawing all reasonable inferences in Arnold Plaintiffs’

favor, we conclude that they have alleged facts sufficient to

support their claim of future injury, notwithstanding the

passage of time and the governmental character of the

22

databases at issue here. Given the nature of the information

stolen and the fact that several named Arnold Plaintiffs have

already experienced some form of identity theft since the

breaches, it is at least plausible that Arnold Plaintiffs run a

substantial risk of falling victim to other such incidents in the

future. See Hutton v. National Bd. of Examiners in Optometry,

Inc., 892 F.3d 613, 621–622 (4th Cir. 2018) (finding a

substantial risk of identity theft where the plaintiffs alleged not

only that their information had been stolen by hackers, but also

that it was subsequently “used in a fraudulent manner”).

Because Arnold Plaintiffs adequately allege a substantial risk

of future identity theft, any expenses they have reasonably

incurred to mitigate that risk likewise qualify as injury in fact.

See id. at 622 (“[T]he [Supreme] Court has recognized standing

to sue on the basis of costs incurred to mitigate or avoid harm

when a substantial risk of harm actually exists.”) (citing

Clapper, 568 U.S. at 414 n.5); see also Hearing Tr. 35 (Oct. 27,

2016) (credit protection services for victims of the breaches

announced in June 2015 were not “up and running until

September” of that year); Arnold Plaintiffs’ Compl. ¶ 28, J.A.

48–49 (Plaintiff Kelly Flynn purchased credit monitoring in

July 2015).

The district court evaluated the second element of Article

III standing, causation, only as to the incidents of identity theft

and fraud that Arnold Plaintiffs had already experienced.

Observing that such incidents were “separated across time and

geography, and they follow no discernable pattern,” In re

OPM, 266 F. Supp. 3d at 38, the court determined that it could

not reasonably infer causation because Arnold Plaintiffs had

not alleged “any facts that plausibly connect the various

isolated incidents of the misuse * * * to the breaches at issue

here,” id. at 37. The district court did not go on to consider

whether Arnold Plaintiffs plausibly alleged that a risk of future

identity theft was fairly traceable to OPM’s and KeyPoint’s

23

cybersecurity failings, presumably because it had already

rejected that risk as merely speculative. We can make

relatively short work of such an inquiry here.

Arnold Plaintiffs have alleged facts supporting a

reasonable inference that their claimed data breach-related

injuries are fairly traceable to OPM’s failure to secure its

information systems. Not only do Arnold Plaintiffs detail

OPM’s failure to heed repeated warnings by its own Inspector

General regarding serious vulnerabilities in the agency’s

systems, but they also allege that as a result of that failure,

hackers managed to breach key OPM systems on several

different occasions.

With respect to KeyPoint, Arnold Plaintiffs further allege

that the company’s failure to properly secure its login

credentials “was a substantial factor in causing the Data

Breaches.” Arnold Plaintiffs’ Compl. ¶ 228, J.A. 99. KeyPoint

contends that Arnold Plaintiffs’ complaint fails to trace the

breaches to any actual misconduct by KeyPoint, but that

argument lacks merit. Arnold Plaintiffs’ complaint alleges not

only that the hackers accessed OPM’s systems “using stolen

KeyPoint credentials,” id. ¶ 127, J.A. 73, but also that the

company was negligent in “failing to protect and secure

its * * * credentials,” id. ¶ 228, J.A. 99, by, among other

things, “failing to * * * comply with industry-standard data

security practices,” id. ¶ 223(b), J.A. 98. It is reasonable to

infer that “data security practices” would cover practices

related to securing credentials. It is likewise reasonable to

infer, based on the allegations contained in the complaint, that

KeyPoint is at least partially to blame for the breaches due to

its failure to comply with such practices.

As previously explained, even if the breaches in question

did not expose all information necessary to make fraudulent

24

charges on victims’ existing financial accounts, the personal

data the hackers did manage to obtain is enough, by itself, to

enable several forms of identity theft. That fact, combined with

the allegations that at least some of the stolen information was

actually misused after the breaches, suffices to support a

reasonable inference that Arnold Plaintiffs’ risk of future

identity theft is traceable to the OPM cyberattacks. Neither the

likelihood that some Arnold Plaintiffs experienced other types

of unrelated fraud nor the speculative possibility that they

might also have been the victims of other data breaches renders

causation implausible here. See In re Zappos.com, Inc., 888

F.3d 1020, 1029 (9th Cir. 2018) (“That hackers might have

stolen Plaintiffs’ [personal identifying information] in

unrelated breaches, and that Plaintiffs might suffer identity

theft or fraud caused by the data stolen in those other

breaches * * * , is less about standing and more about the

merits of causation and damages.”), cert. denied, 139 S. Ct.

1373 (2019). Nor are we troubled, as OPM suggests we should

be, by certain Arnold Plaintiffs’ failure to specify exactly

when, in relation to the data breaches, fraudsters first misused

their data. The Supreme Court has explained that “[a]t the

pleading stage, general factual allegations of injury resulting

from the defendant’s conduct may suffice, for on a motion to

dismiss we presume that general allegations embrace those

specific facts that are necessary to support the claim.” Lujan,

504 U.S. at 561 (formatting altered). Accordingly, as in Attias,

at this early stage, we have “little difficulty concluding,” 865

F.3d at 629, that Arnold Plaintiffs have met their “relatively

modest” burden of alleging that their risk of future identity theft

is fairly traceable to OPM’s and KeyPoint’s challenged

conduct, Bennett v. Spear, 520 U.S. 154, 171 (1997).

This brings us, then, to the final element of standing,

where, as previously noted, we ask whether “it is likely, as

opposed to merely speculative” that Arnold Plaintiffs’ claimed

25

injury “will be redressed by a favorable decision.” Friends of

the Earth, 528 U.S. at 181. Although the district court never

reached this question, we think Arnold Plaintiffs have easily

demonstrated that their substantial risk of future identity theft

and related mitigation expenses are redressable.

Granting that it may well be impossible at this point to

eliminate the risk of future identity theft stemming from the

OPM breaches, the money damages Arnold Plaintiffs seek can

redress certain proven injuries related to that risk (such as

reasonably-incurred credit monitoring costs). See, e.g., In re

Zappos.com, 888 F.3d at 1030 (“The injury from the risk of

identity theft is also redressable by relief that could be obtained

through this litigation. If Plaintiffs succeed on the merits, any

proven injury could be compensated through damages.”)

(citation omitted); Attias, 865 F.3d at 629 (“The fact that

plaintiffs have reasonably spent money to protect themselves

against a substantial risk creates the potential for them to be

made whole by monetary damages.”).

In sum, like the Attias plaintiffs, both sets of plaintiffs here

have “cleared the low bar to establish their standing at the

pleading stage.” 865 F.3d at 622. Arnold Plaintiffs have

plausibly alleged a substantial risk of future identity theft that

is fairly traceable to OPM’s and KeyPoint’s cybersecurity

failings and likely redressable, at least in part, by damages, and

NTEU Plaintiffs have plausibly alleged actual and imminent

constitutional injuries that are likewise traceable to OPM’s

challenged conduct and redressable either by a declaration that

the agency’s failure to protect plaintiffs’ personal information

is unconstitutional or by an order requiring OPM to correct

deficiencies in its cybersecurity program. We therefore have

no need to address the other bases for standing asserted by

NTEU and Arnold Plaintiffs. See, e.g., id. at 626 n.2

(explaining that when plaintiffs have standing “based on their

26

heightened risk of future identity theft,” it is unnecessary to

address their other theories of injury in fact).

Having resolved the standing issue in NTEU and Arnold

Plaintiffs’ favor, we turn to another potential jurisdictional

stumbling block: sovereign immunity.

III

It is “axiomatic” that a waiver of sovereign immunity is a

jurisdictional “prerequisite” for Arnold Plaintiffs’ claims

against OPM to get out of the starting gate. United States v.

Mitchell, 463 U.S. 206, 212 (1983); accord Federal Deposit

Ins. Corp. v. Meyer, 510 U.S. 471, 475 (1994). The Privacy

Act, 5 U.S.C. § 552a, provides just such a waiver of sovereign

immunity. That statute “safeguards the public from

unwarranted collection, maintenance, use and dissemination of

personal information contained in agency records.” Henke v.

Department of Commerce, 83 F.3d 1453, 1456 (D.C. Cir. 1996)

(quoting Bartel v. Federal Aviation Admin., 725 F.2d 1403,

1407 (D.C. Cir. 1984)). As part of that obligation, the Act

mandates that federal agencies “protect the privacy of

individuals identified in information systems maintained by

[them].” Pub. L. No. 93-579, § 2(a)(5), 88 Stat. 1896, 1896

(1974). The Privacy Act waives sovereign immunity by

expressly authorizing a cause of action for damages against

federal agencies that violate its rules protecting the

confidentiality of private information in agency records. See

Tomasello v. Rubin, 167 F.3d 612, 617–618 (D.C. Cir. 1999).

The district court nonetheless ruled that OPM’s sovereign

immunity remained intact, reasoning that Arnold Plaintiffs

failed to allege the type of harms covered by the Privacy Act.

Reviewing the district court’s dismissal of the Privacy Act

claim de novo, Skinner v. Department of Justice, 584 F.3d

27

1093, 1096 (D.C. Cir. 2009), we reverse. OPM’s allegedly

willful failure to protect Arnold Plaintiffs’ sensitive personal

information against the theft that occurred falls squarely within

the Privacy Act’s ambit.

To unlock the Privacy Act’s waiver of sovereign immunity

and state a cognizable claim for damages, a plaintiff must

allege that (i) the agency “intentional[ly] or willful[ly]”

violated the Act’s requirements for protecting the

confidentiality of personal records and information; and (ii) she

sustained “actual damages” (iii) “as a result of” that violation.

5 U.S.C. § 552a(g)(4); see Chichakli v. Tillerson, 882 F.3d 229,

233 (D.C. Cir. 2018). At this threshold stage of the litigation,

Arnold Plaintiffs have plausibly alleged each of those

elements.

A

To start, Arnold Plaintiffs have straightforwardly alleged

a “willful” violation of the Privacy Act’s requirements. 5

U.S.C. § 552a(g)(4). OPM was necessarily aware that the

Privacy Act requires it to “establish appropriate administrative,

technical, and physical safeguards” that “insure the security

and confidentiality of records,” and to “protect against any

anticipated threats or hazards to their security or integrity

which could result in substantial harm, embarrassment,

inconvenience, or unfairness to any individual on whom

information is maintained.” 5 U.S.C. § 552a(e)(10).

The complaint alleges in no uncertain terms that OPM

dropped that ball because appropriate safeguards were not in

place. See, e.g., Arnold Plaintiffs’ Compl. ¶ 134, J.A. 74

(“OPM’s decisions not to comply with [Information Security

Act] requirements for critical security safeguards enabled

hackers to access and loot OPM’s systems for nearly a year

28

without being detected.”); id. ¶ 178, J.A. 87 (“Despite known

and persistent threats from cyberattacks, OPM allowed

multiple ‘material weaknesses’ in its information security

systems to continue unabated. As a result, Plaintiffs’ and Class

members’ [government investigation information] under

OPM’s control was exposed, stolen, and misused.”).

Of course, violating the Privacy Act is not by itself

enough. The agency’s transgression must have been

“intentional or willful.” 5 U.S.C. § 552a(g)(4). Under the

Privacy Act, willfulness means more than “gross negligence.”

Maydak v. United States, 630 F.3d 166, 179 (D.C. Cir. 2010);

see also Coleman v. United States, 912 F.3d 824, 836–837 (5th

Cir. 2019) (“at least gross negligence”); Beaven v. Department

of Justice, 622 F.3d 540, 549 (6th Cir. 2010) (“something

greater than gross negligence”); Hogan v. England, 159 F.

App’x 534, 537 (4th Cir. 2005) (“somewhat greater than gross

negligence”) (formatting altered); Johnston v. Horne, 875 F.2d

1415, 1422 (9th Cir. 1989) (“conduct amounting to more than

gross negligence”), overruled on other grounds, Irwin v.

Department of Veterans Affairs, 498 U.S. 89 (1990).

Allegations that the agency’s conduct was “disjointed” or

“confused,” or that errors were “inadvertent[]” will not suffice.

Maydak, 630 F.3d at 180 (internal quotation marks omitted).

Instead, a complaint must plausibly allege that the

agency’s security failures were “in flagrant disregard of [their]

rights under the Act,” were left in place “without grounds for

believing them to be lawful,” or were “so patently egregious

and unlawful that anyone undertaking the conduct should have

known it unlawful.” Maydak, 630 F.3d at 179; accord 120

Cong. Rec. 40406 (1974) (“Analysis of House and Senate

Compromise Amendments to the Federal Privacy Act”) (“On a

continuum between negligence and the very high standard of

willful, arbitrary, or capricious conduct, this standard is viewed

29

as only somewhat greater than gross negligence.”); see also

Beaven, 622 F.3d at 549 (requiring defendants to have

“committ[ed] the act without grounds for believing it to be

lawful, or flagrantly disregard[ed] others’ rights under the

Privacy Act”) (formatting altered); Andrews v. Veterans

Admin., 838 F.2d 418, 425 (10th Cir. 1988) (agency “action

[must be] so patently egregious and unlawful that anyone

undertaking the conduct should have known it unlawful, or

conduct committed without grounds for believing it to be

lawful or [an] action flagrantly disregarding others’ rights

under the Act”) (formatting altered). 1

Arnold Plaintiffs’ complaint clears that hurdle by plausibly

and with specificity alleging that OPM was willfully indifferent

to the risk that acutely sensitive private information was at

substantial risk of being hacked. According to the complaint,

at the time of the breach, OPM had long known that its

electronic record-keeping systems were prime targets for

hackers. The agency suffered serious data breaches from

hackers in 2009 (millions of users’ personal information stolen)

and 2012 (OPM access credentials stolen and posted online),

and is subject to at least ten million unauthorized electronic

1

Cf. McLaughlin v. Richland Shoe Co., 486 U.S. 128, 132–133

(1988) (“willful” under the Fair Labor Standards Act includes

“reckless[]” violations); Trans World Airlines, Inc. v. Thurston, 469

U.S. 111, 126 (1985) (willfulness in the Age Discrimination in

Employment Act includes “reckless disregard for the matter of

whether [the defendant’s] conduct was prohibited by” the Act);

United States v. Murdock, 290 U.S. 389, 395 (1933) (“willful”

violation of the Revenue Acts of 1926 and 1928 is “marked by

careless disregard [for] whether or not one has the right so to act”);

Dayton Tire v. Secretary of Labor, 671 F.3d 1249, 1254 (D.C. Cir.

2012) (willful violation of the Occupational Safety and Health Act is

“an act done voluntarily with either an intentional disregard of, or

plain indifference to, the Act’s requirements”).

30

intrusion attempts every month. Arnold Plaintiffs’ Compl.

¶¶ 78–79, J.A. 64.

Despite that pervading threat, OPM effectively left the

door to its records unlocked by repeatedly failing to take basic,

known, and available steps to secure the trove of sensitive

information in its hands. Information Security Act audits by

OPM’s Inspector General repeatedly warned OPM about

material deficiencies in its information security systems.

Among the identified flaws were

• severely outdated security policies and procedures;

• permitting employees to leave open, or to not

terminate, remote access;

• understaffed and undertrained cybersecurity

personnel;

• failure to implement or enforce multi-factor

identification in any of its major information

systems;

• declining to patch or install security updates for its

systems promptly;

• lacking a mature vulnerability scanning program to

find and track the status of security weaknesses in

its systems;

• failure to maintain a centralized information

security management structure that would

continuously monitor security events and controls;

• lacking the ability to detect unauthorized devices

connected to its network; and

• failure to engage in appropriate oversight of its

contractor-operated systems.

So forewarned, OPM chose to leave those critical

information security deficiencies (and more) in place. On top

of that, in the year that the hacks occurred, OPM (allegedly)

31

also left undone mandated security assessments and

authorizations for half of its electronic record-keeping systems.

44 U.S.C. § 3554(b); id. § 3544(b) (repealed 2014); Arnold

Plaintiffs’ Compl. ¶¶ 101–102, J.A. 69 (no information

security assessments conducted for eleven of the twenty-one

systems). The risk created by these lapses was so serious that

the Inspector General took the unprecedented step of advising

OPM to shut down all the systems lacking valid authorizations

until adequate security measures could be put in place. OPM

declined, choosing instead to continue operating these systems.

The complaint’s plausible allegations that OPM decided to

continue operating in the face of those repeated and forceful

warnings, without implementing even the basic steps needed to

minimize the risk of a significant data breach, is precisely the

type of willful failure to establish appropriate safeguards that

makes out a claim under the Privacy Act. See American Fed’n

of Gov’t Employees v. Hawley, 543 F. Supp. 2d 44, 52 (D.D.C.

2008) (Department of Homeland Security’s failure to establish

appropriate safeguards to prevent losing a computer hard drive

was “intentional and willful” given the Inspector General’s

repeated warnings of “recurring, systemic, and fundamental

deficiencies” in the agency’s information security); In re

Department of Veterans Affairs (VA) Data Theft Litig., No. 06–

0506 (JR), 2007 WL 7621261, at *4–5 (D.D.C. Nov. 16, 2007)

(Department of Veterans Affairs’ failure to establish

appropriate safeguards to protect against theft of laptop and

hard drive was “intentional and willful” in light of the

Government Accountability Office’s repeated warnings of

“deficiencies” in the agency’s “information security”).

B

Arnold Plaintiffs’ lawsuit is not in the clear yet. The

complaint must also allege facts showing that they suffered

32

“actual damages” as “a result of” OPM’s Privacy Act violation.

5 U.S.C. § 552a(g)(4). The complaint rises to that task as well.

1

“Actual damages” within the meaning of the Privacy Act

are limited to proven pecuniary or economic harm. Federal

Aviation Admin. v. Cooper, 566 U.S. 284, 298–299 (2012).

The district court concluded that only two Arnold Plaintiffs had

properly alleged that they suffered “actual damages”: Jane

Doe, who incurred legal fees when she retained a law firm to

close fraudulent accounts opened in her name, and Charlene

Oliver, whose electricity account had been fraudulently

accessed and saddled with unauthorized charges.

While those harms certainly qualify as actual damages, the

complaint contains still more relevant allegations of injury.

First, nine of the named Arnold Plaintiffs purchased credit

protection and/or credit repair services after learning of the

breach. Paul Daly, for example, purchased credit monitoring

services after a fraudulent 2014 tax return was filed in his

name. And Teresa J. McGarry subscribed to a monthly credit

and identity protection service to prevent identity theft. Those

reasonably incurred out-of-pocket expenses are the

paradigmatic example of “actual damages” resulting from the

violation of privacy protections. See Cooper, 566 U.S. at 298. 2

OPM counters that those individual purchases were

unnecessary because Congress provided credit monitoring

2

Congress authorized the expenditure of hundreds of millions

of taxpayer dollars to purchase ten years’ worth of fraud and credit

monitoring services to protect victims of the data breach. See

Consolidated Appropriations Act, Pub. L. No. 115-31, § 633(a), 131

Stat. 135, 376 (2017).

33

services for potentially affected individuals. Congress, though,

did not offer credit repair services. Anyhow, the argument

wrongly assumes facts in OPM’s favor at the complaint stage,

such as that the services offered were equal or superior to those

obtained privately, or that they took effect in a timely manner

and for a sufficient period of time. See Agnew v. District of

Columbia, 920 F.3d 49, 53 (D.C. Cir. 2019) (on a motion to

dismiss “we assume the truth of all plaintiffs’ plausibly pleaded

allegations, and draw all reasonable inferences in their favor”).

Notably, at least one named plaintiff purchased credit

monitoring services before OPM’s offered services were “up

and running.” Compare Hearing Tr. 35, with Arnold Plaintiffs’

Compl. ¶ 28, J.A 48–49.

Second, seven of the named Arnold Plaintiffs had accounts

opened and purchases made in their names. For example, Kelly

Flynn and her husband had several new credit card accounts

fraudulently opened in their names. They also discovered that

two separate loans totaling $6,400 had been taken out in their

names without their permission and were now delinquent.

Those financial losses qualify as “actual damages.” See

Cooper, 566 U.S. at 298–299.

The district court deemed those damages insufficient

because Arnold Plaintiffs did not further allege that their costs

went unreimbursed. That was error. At this stage of the

litigation, all facts and reasonable inferences must be drawn in

favor of Arnold Plaintiffs, and the complaint provides no basis

for disregarding the claimed financial losses based on OPM’s

speculation that Arnold Plaintiffs were indemnified. See

Hancock v. Urban Outfitters, Inc., 830 F.3d 511, 513–514

(D.C. Cir. 2016).

Anyhow, “an injured person may usually recover in full

from a wrongdoer regardless of anything he may get from a

34

collateral source unconnected with the wrongdoer.” Kassman

v. American Univ., 546 F.2d 1029, 1034 (D.C. Cir. 1976) (per

curiam) (formatting altered); accord Restatement (Second) of

Torts § 920A(2). That rule prevents the victim’s benefits from

becoming the tortfeasor’s windfall. See Hudson v. Lazarus,

217 F.2d 344, 346 (D.C. Cir. 1954). So too here.

OPM also objects that only some forms of reimbursement

qualify for the collateral source rule. Gov’t Br. 45. Again,

OPM gets the cart before the horse, because the complaint

contains no allegations about recompense at all, let alone what

their sources were. OPM’s argument also offers an overly

cramped vision of the collateral source rule. See Hudson, 217

F.2d at 346 (without limiting the collateral source rule’s

application, observing that it applies to “gift[s] or the product

of a contract of employment or of insurance”); Restatement

(Second) of Torts § 920A cmt. c (offering a non-exclusive list

of “types of benefits” to which the collateral source rule

applies); see also, e.g., Temme v. Bemis Co., 762 F.3d 544, 549

(7th Cir. 2014) (per curiam) (applying the collateral source rule

to attorneys’ fees payments).

Third, Plaintiffs Kelly Flynn and six others had false tax

returns filed using their information and have experienced

delays in receiving federal and state tax refunds. The delay in

those Plaintiffs’ receipt of their refunds, and the forgone time

value of that money, is an actual, tangible pecuniary injury.

OPM argues “no harm, no foul” because the Internal

Revenue Service must pay taxpayers interest due for delayed

refunds. See 26 U.S.C. § 6611. That misses the mark. To start,

interest on tax overpayments is itself taxable income, id.

§ 61(a)(4); Megibow v. Commissioner, 102 T.C.M. (CCH) 232

(2011), while interest incurred in taking out loans to cover the

delayed refunds is not deductible, 26 U.S.C. § 163(h)(1). That

35

makes the IRS’s payment scheme inherently under

compensatory. On top of that, the IRS pays interest only on

delayed federal refunds, not state tax refunds. Arnold

Plaintiffs’ Compl. ¶ 28, J.A. 49 (alleging delay in state tax

refund); see generally 26 U.S.C. § 6611(a) (“Interest shall be

allowed and paid upon any overpayment in respect of any

internal revenue tax.”) (emphasis added).

Lastly, one Plaintiff, Lillian Gonzalez-Colon, spent more

than 100 hours to resolve the fraudulent tax return filing and to

close a fraudulently opened account. Those efforts “required

her to take time off work[]” to address the consequences of the

OPM breach. Arnold Plaintiffs’ Compl. ¶ 31, J.A. 50–51; see

Beaven, 622 F.3d at 557–559 (concluding that plaintiffs could

claim damages for “lost time” spent “dealing with the

disclosure” of their Bureau of Prison personnel files).

OPM urges us to hold Gonzalez-Colon to Federal Rule of

Civil Procedure 9(g)’s requirement that “special damages” be

“specifically stated.” Fed. R. Civ. P. 9(g). We have not yet

addressed whether Rule 9(g)’s heightened pleading standard

applies to Privacy Act claims, and we have no occasion to do

so here. Gonzalez-Colon’s specific allegations about the time

lost from work addressing the fraudulent tax return and

Verizon Wireless account suffice either way. See 5A Charles

A. Wright & Arthur R. Miller, Federal Practice & Procedure

§ 1311 (4th ed. 2019) (“[A]llegations of special damage will be

deemed sufficient for the purpose of Rule 9(g) if they are

definite enough to notify the opposing party and the court of

the nature of the damages and enable the preparation of a

responsive pleading.”).

For all of those reasons, Arnold Plaintiffs have adequately

alleged actual damages within the meaning of the Privacy Act.

36

2

The complaint also explains how Arnold Plaintiffs’ actual

damages were the “result of” OPM’s Privacy Act violations. 5

U.S.C. § 552a(g)(4)(A).

To meet the Privacy Act’s causation requirement, Arnold

Plaintiffs must plausibly allege that the OPM hack was the

“proximate cause” of their damages. Dickson v. Office of Pers.

Mgmt., 828 F.2d 32, 37 (D.C. Cir. 1987). That is, OPM’s

conduct must have been a “substantial factor” in the sequence

of events leading to Arnold Plaintiffs’ injuries, and those

injuries must have been “reasonably foreseeable or anticipated

as a natural consequence” of OPM’s conduct. Owens v.

Republic of Sudan, 864 F.3d 751, 794 (D.C. Cir. 2017). To be

the proximate cause is not necessarily to be the sole cause. See

Hecht v. Pro-Football, Inc., 570 F.2d 982, 996 (D.C. Cir.

1977). OPM was the proximate cause of the harm befalling

Arnold Plaintiffs so long as its conduct created a foreseeable

risk of harm through the hackers’ intervention. See Staub v.

Proctor Hosp., 562 U.S. 411, 420 (2011); Restatement

(Second) of Torts § 442A.

The complaint alleges facts demonstrating proximate

cause. Arnold Plaintiffs contend that OPM’s failure to

establish appropriate information security safeguards opened

the door to the hackers, giving them ready access to a

storehouse of personally identifiable and sensitive financial

information. In particular, the complaint explains that OPM’s

failure to adopt basic protective measures “foreseeably

heightened the risk of a successful intrusion into OPM’s

systems.” Arnold Plaintiffs’ Compl. ¶ 134, J.A. 74. And its

decisions to disregard the Inspector General’s repeated

warnings and “not to comply with [Information Security Act]

requirements for critical security safeguards enabled hackers to

37

access and loot OPM’s systems for nearly a year without being

detected.” Id.; see id. ¶¶ 105–113, J.A. 70–71.

The proof is in the pudding: Numerous Arnold Plaintiffs

suffered forms of identity theft accomplishable only with the

type of information that OPM stored and the hackers accessed.

That directly links the hack to the theft of the victims’ private

information, the pecuniary harms suffered, and the ongoing

increased susceptibility to identity theft or financial injury. See

Arnold Plaintiffs’ Compl. ¶¶ 14, 17, 21–22, 24–26, 28–29, 31–

32, 34, 39–41, 45, 49, J.A. 40–59; Attias v. CareFirst, Inc., 865

F.3d 620, 629 (D.C. Cir. 2017) (plaintiffs plausibly alleged risk

of identity theft for Article III standing purposes based on the

nature of the stolen data), cert. denied, 138 S. Ct. 981 (2018). 3

To argue, as OPM does, that the presumed occurrence of other

data breaches defeats a causal connection as a matter of law at

this early stage again wrongly construes inferences drawn from

generic assertions about the general risk of data breaches in the

government’s favor. The law would embody quite a “perverse

3

See also Resnick v. AvMed, Inc., 693 F.3d 1317, 1327 (11th

Cir. 2012) (plaintiffs plausibly alleged that data breach proximately

caused their identity theft for purposes of Florida law by “alleg[ing]

that the sensitive information on the stolen laptop was the same

sensitive information used to steal Plaintiffs’ identity”); Stollenwerk

v. Tri–West Health Care All., 254 F. App’x 664, 667 (9th Cir. 2007)

(plaintiff established that data breach proximately caused identity

theft for purposes of Arizona law where plaintiff provided his

personal information to defendant, the identity fraud incidents began

six weeks after defendant’s systems were compromised, and plaintiff

had not previously suffered from identity theft); In re Community

Health Sys., Inc., No. 15-CV-222-KOB, 2016 WL 4732630, at *25

(N.D. Ala. Sept. 12, 2016) (plaintiff plausibly alleged causal link

between data breach and identity theft by “alleg[ing] misuse

occurring subsequent to the breach that would be consistent with the

type of data stolen”).

38

incentive” were it to hold at this threshold stage of litigation

that, “so long as enough data breaches take place,” agencies

“will never be found liable.” In re Equifax, Inc., Customer

Data Security Breach Litig., 362 F. Supp. 3d 1295, 1318 (N.D.

Ga. 2019) (formatting altered); accord In re Anthem, Inc. Data

Breach Litig., 162 F. Supp. 3d 953, 988 (N.D. Cal. 2016).

In any event, OPM makes no claim that these particular

plaintiffs have been subjected to hacks of equivalent breadth

and depth, sweeping in such acutely sensitive personal

information as Social Security numbers, fingerprints, and birth

certificates.

In sum, Arnold Plaintiffs have adequately alleged (i) that

OPM willfully chose not to establish basic and necessary

information security safeguards in violation of Section

552a(e)(10) of the Privacy Act, and (ii) that those actions

proximately caused (iii) actual damages in multiple, specific

ways. Because the complaint, at this threshold stage, states a

viable Privacy Act claim, OPM’s sovereign immunity has been

waived.

IV

In addition to their Privacy Act claim against OPM,

Arnold Plaintiffs assert statutory and common law claims

against OPM’s contractor, KeyPoint Government Solutions.

Arnold Plaintiffs’ Compl. ¶¶ 208–275, J.A. 94–110 (alleging

negligence, negligent misrepresentation and concealment,

invasion of privacy, violation of the Fair Credit Reporting Act,

15 U.S.C. § 1681, violation of “State Statutes Prohibiting

Unfair and Deceptive Trade Practices,” violation of “State Data

Breach Acts,” and breach of contract).

39

OPM tasked KeyPoint with performing background and

security clearance investigations and inputting the sensitive

information it collected into OPM’s electronic recordkeeping

system. The hackers allegedly were able to obtain KeyPoint

credentials and then used them to gain access to OPM’s

network. See Arnold Plaintiffs’ Compl. ¶ 106, J.A. 70.

The district court held that, as OPM’s contractor, KeyPoint

enjoyed “derivative sovereign immunity” from those claims.

We review the applicability of derivative sovereign immunity

de novo, see Cunningham v. General Dynamics Info. Tech.,

Inc., 888 F.3d 640, 645 (4th Cir. 2018), cert. denied, 139 S. Ct.

417 (2018), and find no basis for its application in this case.

OPM’s contract obligated KeyPoint to meet the same standards

for protecting personal information that the Privacy Act

imposes directly on OPM. Because the improper conduct

alleged would have violated the Privacy Act if committed by

OPM itself and because KeyPoint’s challenged misconduct

was not directed by OPM, there is no sovereign immunity for

KeyPoint to derive. 4

As a private company, KeyPoint ordinarily would not

enjoy immunity against the statutory and tort claims asserted

by Arnold Plaintiffs. But government contractors may

sometimes “obtain certain immunity in connection with work

which they do pursuant to their contractual undertakings with

the United States.” Campbell-Ewald Co. v. Gomez, 136 S. Ct.

663, 672 (2016) (internal quotation marks omitted) (quoting

Brady v. Roosevelt S.S. Co., 317 U.S. 575, 583 (1943)).

4

Neither OPM nor the Justice Department in its brief in this

case has endorsed KeyPoint’s claim of derivative sovereign

immunity.

40

Derivative sovereign immunity, though, is less

“embracive” than the immunity a sovereign enjoys. Campbell-

Ewald, 136 S. Ct. at 672. It applies only when a contractor

takes actions that are “authorized and directed by the

Government of the United States,” and “performed pursuant to

the Act of Congress” authorizing the agency’s activity. Id. at

673. In that way, derivative sovereign immunity ensures that

“‘there is no liability on the part of the contractor’ who simply

performed as the Government directed.” Id. (quoting Yearsley

v. W.A. Ross Constr. Co., 309 U.S. 18, 21 (1940)); id. at 673

n.7 (“Critical in Yearsley was not the involvement of public

works, but the contractor’s performance in compliance with all

federal directions.”). Said another way, a government

contractor that “violates both federal law and the government’s

explicit instructions” loses the shield of derivative immunity

and is subject to suit by those adversely affected by the

contractor’s violations. Id. at 672.

Like the plaintiff in Campbell-Ewald, Arnold Plaintiffs

have plausibly alleged that KeyPoint’s failure to secure its

credentials ran afoul of both OPM’s explicit instructions and

federal law standards, rendering derivative sovereign immunity

unavailable.

At the outset, KeyPoint’s failure to place in the record its

contract with OPM makes it particularly difficult for it to

establish, on a motion to dismiss, that its alleged security lapses

were “authorized and directed” by OPM, Campbell-Ewald, 136

S. Ct. at 673 (quoting Yearsley, 309 U.S at 20). See generally

Banneker Ventures, LLC v. Graham, 798 F.3d 1119, 1133

(D.C. Cir. 2015).

In fact, Privacy Act regulations require OPM, when

contracting “for the operation * * * of a system of records to

accomplish an agency function,” to “cause the requirements”

41

of the Privacy Act to be “applied to such system.” 5 U.S.C.

§ 552a(m)(1); see 48 C.F.R. §§ 24.102(a), 24.104, 52.224-2.

KeyPoint does not deny that. So KeyPoint was obligated by

contract and regulation to, among other things, establish

“appropriate safeguards to insure the security and

confidentiality of records.” 5 U.S.C. § 552a(e)(10); see Arnold

Plaintiffs’ Compl. ¶ 123, J.A. 72–73.

The complaint expressly asserts that KeyPoint failed to

fulfill those obligations, which led to the break-in. KeyPoint

allegedly violated its regulatory and contractual obligations,

among other things, to (i) “secure its systems for gathering and

storing” government investigation information despite

“knowing of [its] vulnerabilities;” (ii) “comply with industry-

standard data security practices;” (iii) “perform requisite due

diligence and supervision in expanding its workforce;” (iv)

“encrypt [government investigation information] at collection,

at rest, and in transit;” (v) “employ adequate network

segmentation and layering;” (vi) “ensure continuous system

and event monitoring and recording;” and (vii) “otherwise

implement security policies and practices sufficient to protect

* * * [government investigation information] from

unauthorized disclosure.” Arnold Plaintiffs’ Compl. ¶ 223,

J.A. 98. Notably, it was KeyPoint’s alleged failure to secure

and protect its employees’ log-in credentials that allowed the

hackers to access OPM’s system in May 2014, and it was from

there that the hackers ultimately stole 21.5 million background

investigation records.

Unsurprisingly, KeyPoint does not argue that OPM

“authorized and directed” it to design its system with the

security flaws that Arnold Plaintiffs identify. Campbell-

Ewald, 136 S. Ct. at 673. So KeyPoint cannot wrap itself in

derivative immunity garb on the ground that it “simply

performed as the Government directed.” Id.

42

The district court felt differently, concluding that

derivative immunity applied because the Privacy Act is wholly

inapplicable to KeyPoint. It is true that the Privacy Act itself

does not apply directly to government contractors like

KeyPoint. See Abdelfattah v. Department of Homeland

Security, 787 F.3d 524, 533 n.4 (D.C. Cir. 2015) (“[T]he

Privacy Act creates a cause of action against only federal

government agencies and not private corporations or individual

officials.”).

But that is beside the point. To claim immunity, KeyPoint

had to establish “compliance with all federal directions”

pertaining to its relevant conduct, including the regulatory and

contractual obligation to meet the Privacy Act’s standards in its

contract operations. Campbell-Ewald, 136 S. Ct. at 673 n.7.

So what matters for derivative sovereign immunity

purposes is KeyPoint’s (i) inability to point to a contractual

provision or other OPM direction authorizing or directing the

very gaps in security protections over which Arnold Plaintiffs

are suing, and (ii) its regulatory duty to ensure informational

security equivalent to that demanded by the Privacy Act. 48

C.F.R. §§ 24.102(a), 24.104, 52.224-2. Add to that the absence

of sovereign immunity protections for OPM from the Privacy

Act claims in this case, and the sovereign immunity well from

which KeyPoint seeks to draw has run dry.

The district court also pointed to Section 552a(m)(1) of the

Privacy Act, which provides that the contractor and its

employees “shall be considered employees of the agency[,]”

and to a regulation providing that “the system of records

operated under the contract is deemed to be maintained by the

agency.” In re OPM, 266 F. Supp. 3d at 48–49 (quoting 48

43

C.F.R. § 24.102(c)). Neither supports the application of

derivative sovereign immunity here.

Even under the district court’s reading, Section

552a(m)(1) hurts rather than helps KeyPoint. OPM’s and its

employees’ own immunity has been waived. So treating

KeyPoint employees like OPM employees gets KeyPoint

nowhere. It cannot derive an immunity that OPM itself does

not have. See Campbell-Ewald, 136 S. Ct. at 666 (asking

whether “the sovereign’s immunity from suit shield[s] the

[contractor] * * * as well”) (emphasis added); see also

Contango Operators, Inc. v. United States, 965 F. Supp. 2d

791, 814 (S.D. Tex. 2013) (because “[n]o sovereign immunity

has been established,” the court “therefore concludes that there

is no governmental immunity from which an immunity may be

derived for the benefit of” the contractor), aff’d sub nom.

Contango Operators, Inc. v. Weeks Marine, Inc., 613 F. App’x

281 (5th Cir. 2015); cf. McMahon v. Presidential Airways, Inc.,

502 F.3d 1331, 1345 (11th Cir. 2007) (reasoning that if a

federal officer cannot claim complete derivative immunity,

then neither can a mere common law agent, because otherwise

“a prison guard employed by the government would have only

qualified immunity, while a private contractor who works in

the prison but is no more than a common law agent would have

absolute immunity”).

After all, the driving purpose of derivative sovereign

immunity “is to prevent the contractor from being held liable

when the government is actually at fault but is otherwise

immune from liability.” In re World Trade Center Disaster

Site Litig., 456 F. Supp. 2d 520, 560 (S.D.N.Y. 2006) (internal

quotation marks omitted), aff’d, 521 F.3d 169 (2d Cir. 2008);

cf. Filarsky v. Delia, 566 U.S. 377, 390–391 (2012) (if

qualified immunity is withheld from private individuals “acting

on behalf of the government,” “government employees will

44

often be protected from suit by some form of immunity, [while]

those working alongside them could be left holding the bag—

facing full liability for actions taken in conjunction with

government employees who enjoy immunity for the same

activity”).

In any event, the district court overread the statute. When

the Privacy Act speaks of contractors as “employees” of the

agency, it does so for the purpose of extending criminal

liability to contractors and their employees if they violate

certain Privacy Act requirements. 5 U.S.C. § 552a(i), (m)(1).

Congress’s decision to subject federal contractors to the same

Privacy Act criminal prohibitions as their agency employers

hardly augurs in favor of according those same contractors

more protection from civil liability than the agency itself.

As for the district court’s reliance on 48 C.F.R.

§ 24.102(c), that regulation says nothing about contractors’

responsibility for complying with their contractual and

regulatory obligations. The rule simply holds the contracting

agency responsible for “the system of records operated under

the contract.” 48 C.F.R. § 24.102(c), (d). Which makes sense.

Otherwise, the government would be able to contract itself out

of the Privacy Act obligations that Congress imposed.

Beyond that, KeyPoint’s argument frequently mixes

apples and oranges, citing preemption cases in an effort to

substantiate its claim to derivative immunity. KeyPoint Br.

24–26. That tactic will not work. Those preemption cases do

not turn on the applicability of derivative sovereign immunity.

And KeyPoint has not raised a preemption argument in this

court, so any argument to that effect is forfeited for purposes of

this appeal. See Al-Tamimi v. Adelson, 916 F.3d 1, 6 (D.C. Cir.

2019) (“A party forfeits an argument by failing to raise it in his

opening brief.”).

45

In sum, derivative sovereign immunity has its limits.

KeyPoint exceeded those limits, and for that reason cannot don

the cloak of derivative sovereign immunity.

V

Finally, we turn to NTEU Plaintiffs’ constitutional claim.

In that claim, NTEU Plaintiffs do not allege that OPM

intentionally disclosed the records at issue or performed the

functional equivalent of such a disclosure. See, e.g., NTEU

Plaintiffs’ Compl. ¶ 97, J.A. 186 (alleging “reckless

indifference”). Instead, NTEU Plaintiffs challenge OPM’s

internal record-management and storage practices and policies

as unconstitutionally trenching on their asserted constitutional

right to privacy. See, e.g., id. at 3, J.A. 155 (“Although on

notice of serious flaws in its data system security, OPM failed

to adequately secure personal information in its possession—a

failure that was reckless under the circumstances.”). They

appear to rely on two closely related threads of constitutional

doctrine, one couched in terms of privacy and relying mainly

on dicta from Whalen v. Roe, 429 U.S. 589 (1977), the other

phrased more directly in terms of substantive due process and

relying mainly on cases providing relief for persons harmed

through government neglect of their personal safety. We

address them in that order.

A

As NTEU Plaintiffs see it, the Constitution creates a “zone

of privacy” that protects an individual’s “interest in avoiding

disclosure of personal matters.” NTEU Br. 36 (quoting

Whalen, 429 U.S. at 598–599). This putative right to

“informational privacy,” they contend, is violated not only

where government agents intentionally disclose an individual’s

46

personal information, but where, as alleged here, the agents

“reckless[ly]” fail to prevent a third party from stealing it.

NTEU Plaintiffs’ Compl. 3, J.A. 155; see also Oral Arg. Tr.

44:23–45:5.

Even assuming “without deciding[] that the Constitution

protects” some “sort” of privacy “interest in avoiding

disclosure of personal matters,” NASA v. Nelson, 562 U.S. 134,

138 (2011) (quoting Whalen, 429 U.S. at 599–600), NTEU

Plaintiffs have failed to state a legally cognizable claim. There

is no authority for their contention that the Constitution

imposes on the government an affirmative duty—untethered to

specific constitutional provisions such as the First Amendment,

see, e.g., Americans for Prosperity Found. v. Becerra, 903 F.3d

1000, 1019 (9th Cir. 2018)—to “safeguard personal

information” from the criminal acts of third parties, NTEU

Plaintiffs’ Compl. ¶ 97, J.A. 186.

The asserted duty to “adequately secure” government

computer networks finds no support in the Constitution or our

history. NTEU Plaintiffs’ Compl. 3, J.A. 155. Not once do

NTEU Plaintiffs quote the very document from which they

purport to derive their claimed right: the Constitution of the

United States. Nor, for that matter, do they invoke this

“Nation’s history and tradition,” Aka v. United States Tax

Court, 854 F.3d 30, 34 (D.C. Cir. 2017) (quoting Washington

v. Glucksberg, 521 U.S. 702, 720–721 (1997))—an integral

part of the formula for identifying unenumerated rights.

NTEU Plaintiffs instead ground their claim in a single line

of Supreme Court dictum from more than 40 years ago that

describes “[t]he cases sometimes characterized as protecting

‘privacy’” as involving, among other interests, a vague

“individual interest in avoiding disclosure of personal matters.”

NTEU Br. 36 (quoting Whalen, 429 U.S. at 599). But neither

47

we nor the Supreme Court has ever held that this interest is a

constitutional right. American Fed’n of Gov’t Employees v.

Department of Hous. & Urban Dev., 118 F.3d 786, 791 (D.C.

Cir. 1997) (“The Supreme Court has addressed the issue in

recurring dicta without, we believe, resolving it.”). Both courts

have, so far, steadfastly rejected all informational privacy

claims purporting to rest on the Constitution, while simply

“assum[ing]”—but never “deciding”—that the Constitution

protects a “right of the sort mentioned in Whalen.” NASA, 562

U.S. at 138; see Nixon v. Administrator of Gen. Servs., 433 U.S.

425, 457–458 (1977); Whalen, 429 U.S. at 605; American

Fed’n of Gov’t Employees, 118 F.3d at 791. Indeed, neither

this court nor the Supreme Court has ever elaborated on the

rationale for—or even defined the “precise contours of”—the

putative right to informational privacy. American Fed’n of

Gov’t Employees, 118 F.3d at 793; see also, e.g., NASA, 562

U.S. at 147–148. Rather, we have underlined its “ambiguity.”

National Fed’n of Fed. Employees v. Greenberg, 983 F.2d 286,

293 (D.C. Cir. 1993); cf. Siegert v. Gilley, 500 U.S. 226, 233–

234 (1991) (holding that even malicious government

defamation does not trigger constitutional protection) (citing

Paul v. Davis, 424 U.S. 693 (1976)).

Other circuits, to be sure, have embraced a form of the

putative right. See, e.g., In re Crawford, 194 F.3d 954, 958

(9th Cir. 1999); see also NASA, 562 U.S. at 146 n.9 (collecting

cases). But see Doe v. Wigginton, 21 F.3d 733, 740 (6th Cir.

1994). But NTEU Plaintiffs have identified no case in which

the government has been held to have violated the alleged right

without having “affirmatively provid[ed] the protected

information to those unauthorized to view it.” NTEU Br. 47

(emphasis added). Neither have we. Absent any plausible

mooring in the Constitution’s text or the Nation’s history and

tradition, we join the district court in declining to recognize the

proposed constitutional right to informational privacy that

48

would be violated not only when information is intentionally

disclosed (or the functional equivalent), but also “when a third

party steals it.” In re OPM, 266 F. Supp. 3d at 46.

Troubled as we are by NTEU Plaintiffs’ allegations

regarding the severity and scope of OPM’s data security

shortcomings, we are nonetheless reluctant to constitutionalize

an information security code for the government’s “internal

operations.” NASA, 562 U.S. at 151 (citing Engquist v. Oregon

Dep’t of Agric., 553 U.S. 591, 598–599 (2008)). OPM

“collect[ed] and store[d]” the information at issue here not as

sovereign, but as employer—in “its role as the federal civil

service’s personnel manager.” NTEU Plaintiffs’ Compl. ¶ 10,

J.A. 159. In this capacity—“‘as proprietor’ and manager of

[the government’s] ‘internal operation,’” NASA, 562 U.S. at

148 (quoting Cafeteria & Rest. Workers Union v. McElroy, 367

U.S. 886, 896 (1961))—OPM was “dealing ‘with citizen

employees,’” and thus had a “much freer hand” than it would

have had if it had brought “its sovereign power to bear on

citizens at large,” id. (emphasis added) (quoting Engquist, 553

U.S. at 598). That “freer hand” exists for good reason.

Whereas the “Constitution requires that a President chosen by

the entire Nation oversee the execution of the laws,” albeit by

a “vast and varied federal bureaucracy,” Free Enter. Fund v.

Public Co. Accounting Oversight Bd., 561 U.S. 477, 499

(2010), constitutionally micromanaging employment records

management systems, reaching down to the details of “how

[best] to protect” the “information systems” holding employee

data, NTEU Br. 48, would shift a material part of that oversight

function to the judiciary, which generally lacks established

standards or guideposts for making such administrative

judgments—at least in the absence of congressional direction.

Cf. Bishop v. Wood, 426 U.S. 341, 349–350 (1976).

49

Another reason counsels hesitation. Establishing judicial

supervision over the security of the government’s employee

data would “short-circuit” the response that Congress has

already launched. District Attorney’s Office for Third Judicial

Dist. v. Osborne, 557 U.S. 52, 73 (2009) (citing Glucksberg,

521 U.S. at 720). As the Supreme Court observed in NASA,

Congress has in the Privacy Act adopted significant

“protections against disclosure” of personal information that

“‘evidence a proper concern’ for individual privacy.” 562 U.S.

at 156 (quoting Whalen, 429 U.S. at 605). Here, as there, the

Act limits the government’s ability to maintain records “about

an individual,” 5 U.S.C. § 552a(e)(1), and “imposes criminal

liability for willful violations of its nondisclosure obligations,”

562 U.S. at 156 (citing 5 U.S.C. § 552a(i)(1)). NTEU

Plaintiffs, of course, allege that OPM has “fail[ed] to satisfy”

these obligations, NTEU Plaintiffs’ Compl. ¶ 97, J.A. 186, and

argue that their “inherently personal information remains at

substantial risk of additional breaches because” of OPM’s

failures, Oral Arg. Tr. 49:17–19. But if NTEU Plaintiffs are

right (as we must assume in the current posture of the case),

then they may invoke the remedial provisions found by

Congress to best balance privacy and competing interests. See

5 U.S.C. § 552a(g)(1)(D), (g)(4); cf. supra Part III.A (reversing

dismissal of Arnold Plaintiffs’ Privacy Act claims).

Establishing a freestanding constitutional right to

informational privacy that creates a duty to safeguard personal

information from unauthorized access by third parties would

force us to develop a labyrinth of technical rules. See Osborne,

557 U.S. at 73–74. For example, does the Constitution require

data “encrypt[ion]”? NTEU Br. 6 (citing NTEU Plaintiffs’

Compl. ¶¶ 51–52, J.A. 172–173). If so, must all data be

encrypted in transit, as well as at rest? Cf. Arnold Plaintiffs’

Compl. ¶¶ 136, 223, J.A. 75, 98. What of the encryption key:

Is 256 bits necessary—or would 128 bits scrape by,

50

constitutionally speaking? See Orin S. Kerr & Bruce Schneier,

Encryption Workarounds, 106 Geo. L.J. 989, 993 (2018)

(illustrating the difference). How about “personal identity

verification (PIV) credentials”—are they constitutionally

mandated? NTEU Plaintiffs’ Compl. ¶ 47, J.A. 171 (internal

quotation marks omitted). And most significant: What “tools”

should “federal courts * * * use to answer” these questions?

Osborne, 557 U.S. at 74. NTEU Plaintiffs do not say; more

important, neither does the Constitution.

We therefore hold that, assuming (without deciding) the

existence of a constitutional right to informational privacy, see,

e.g., NASA, 562 U.S. at 138; American Fed’n of Gov’t

Employees, 118 F.3d at 791, it affords relief only for intentional

disclosures or their functional equivalent—which NTEU

Plaintiffs do not allege.

B

NTEU Plaintiffs also seek to ground their claim in the Due

Process Clause of the Fifth Amendment, contending

specifically that, in some instances, “reckless or deliberate

indifference” (as opposed to intentional misconduct) “may

‘shock the conscience sufficiently to violate due process.’”

NTEU Reply Br. 13 (quoting Smith v. District of Columbia,

413 F.3d 86, 93 (D.C. Cir. 2005)); see also NTEU Br. 47–48;

Oral Arg. Tr. 74:3–9. True enough. See, e.g., United States v.

Salerno, 481 U.S. 739, 746 (1987) (citing Rochin v. California,

342 U.S. 165, 172 (1952)).

But the conscience’s susceptibility to shock varies

radically with whether the government has previously taken an

“affirmative act of restraining the individual’s freedom to act

on his own behalf—through incarceration, institutionalization,

or similar restraint of personal liberty.” DeShaney v.

Winnebago Cnty. Dep’t of Soc. Servs., 489 U.S. 189, 200

51

(1989). Thus, a prisoner who has “already been deprived of

[his] liberty,” for example, has a plausible claim to affirmative

governmental protection. Collins v. City of Harker Heights,

503 U.S. 115, 127 (1992); see also Smith, 413 F.3d at 94–95

(same for “juvenile delinquent held ‘against his will’”). Absent

such a restraint, however, the government’s “failure to protect

an individual from private [acts], even in the face of known

danger, [generally] ‘does not constitute a violation of the Due

Process Clause.’” Butera v. District of Columbia, 235 F.3d

637, 647 (D.C. Cir. 2001) (quoting DeShaney, 489 U.S. at 197).

“The state must protect those it throws into snake pits, but the

state need not guarantee that volunteer snake charmers will not

be bitten.” Walker v. Rowe, 791 F.2d 507, 511 (7th Cir. 1986)

(explaining that although a state has a constitutional duty to

protect prisoners in its custody, it has no such obligation toward

prison guards who have voluntarily accepted employment with

the state).

Here, NTEU Plaintiffs’ claims fall on the wrong side of

this line; they assert an affirmative government duty to

safeguard personal information that current and prospective

employees voluntarily submitted to the government.

This lack of compulsion makes all the difference. In

Collins, for example, the Supreme Court rejected the claim—

made by the widow of a city sanitation worker killed in the

performance of his duties—that the Due Process Clause

required the government to “provide its employees with certain

minimal levels of safety and security.” 503 U.S. at 127. A

government employee, the Court reasoned, could not maintain

“that the [government] deprived [him] of his liberty”—and thus

incurred a “continuing obligation” to protect that liberty by

guaranteeing him a minimum level of safety and security—

“when it made, and he voluntarily accepted, an offer of

employment.” Id. at 128. That is precisely why, applying the

52

principle in cases posing the distinction most directly, we have

rejected claims by prison guards. See Fraternal Order of

Police Dep’t of Corrs. Labor Comm. v. Williams, 375 F.3d

1141, 1147 (D.C. Cir. 2004); Washington v. District of

Columbia, 802 F.2d 1478, 1482 (D.C. Cir. 1986).

Similar logic applies here. Like the sanitation worker in

Collins—and the prison guards in Williams and Washington—

NTEU Plaintiffs “voluntarily” sought and “accepted” an “offer

of [government] employment.” Collins, 503 U.S. at 128. In

doing so, they voluntarily submitted personal information “as

part of a background investigation.” NTEU Plaintiffs’ Compl.

¶ 60, J.A. 176. In no sense, then, did the government compel

NTEU Plaintiffs to seek government employment; it therefore

bore no constitutional duty under the Due Process Clause to

protect them from the risks associated with applying for such

positions. With no triggering deprivation of liberty or property

to speak of, there arose no constitutional governmental duty to

“provide [NTEU Plaintiffs] with certain minimal levels of

safety and security,” Collins, 503 U.S. at 127—physical or

digital.

VI

In sum, we reverse in part and affirm in part. We hold that

(i) NTEU and Arnold Plaintiffs have adequately alleged Article

III standing; (ii) Arnold Plaintiffs have stated a claim under the

Privacy Act, which waives OPM’s sovereign immunity; (iii)

KeyPoint is not protected by derivative sovereign immunity;

and (iv) NTEU Plaintiffs have failed to state a claim that flaws

in OPM’s information-storage measures violated the

Constitution. We remand for further proceedings consistent

with this opinion.

So ordered.

WILLIAMS, Senior Circuit Judge, concurring in part and

dissenting in part:

Why did “sophisticated” cyberintruders spend several

months systematically and covertly extracting 21.5 million

highly sensitive background investigation records for federal

government employees from the Office of Personnel

Management? Arnold Plaintiffs’ Compl. ¶ 128, J.A. 73.

Plaintiffs’ answer is identity theft. Might the hackers have

been members of a criminal syndicate looking to sell the

information to identity thieves on the dark web to bilk victims

such as Mr. Travis Arnold out of “approximately $125”? Id.

¶ 13, J.A. 40. Yes, theoretically. But as a basis for standing

for most Arnold Plaintiffs the garden-variety identity theft

theory lacks the necessary plausibility in light of an obvious

alternative explanation: The breach “d[oes] not plausibly

suggest” identity theft as the motive (and hence a source of

future harm) because it is “more likely explained” as the

handiwork of foreign spies looking to harvest information

about millions of federal workers for espionage or kindred

purposes having nothing to do with identity theft. Ashcroft v.

Iqbal, 556 U.S. 662, 680 (2009); see Br. of Chamber of

Commerce of U.S. as Amicus Curiae in Support of Appellees

6 (“Nation-states frequently target personally identifying

information . . . in order to spy on certain individuals.”

(brackets omitted)).

My colleagues do not deny the possibility. See Maj. op.

17 (“[A] cyberattack on a government system might well be

motivated by a purpose other than identity theft . . . .”). Yet, in

assessing standing, they conclude that “all” 21.5 million

Arnold Plaintiffs have “plausibly alleged a substantial risk”

that they will, due to this particular data breach, suffer “future

identity theft.” Id. at 14, 25.

Respectfully, I disagree. Because Arnold Plaintiffs have

failed to allege facts that would tend to negate the “obvious

2

alternative explanation” for the breach (i.e., espionage), they

have not, in my view, “nudged [their] claims . . . across the line

from conceivable to plausible.” Iqbal, 556 U.S. at 680, 682

(quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 567,

570 (2007)). I would therefore affirm the dismissal of Arnold

Plaintiffs’ claims for lack of standing—with one exception,

discussed below. As a result, I join the court’s opinion in full

except with respect to any portions that are inconsistent with

this dissent, including but not limited to Parts II.B (holding that

Arnold Plaintiffs stated a plausible claim to standing) and

III.B.2 (holding that Arnold Plaintiffs stated a plausible claim

that their injuries were the “result of” the breach).

* * *

Two aspects of the standing analysis are important here.

First, standing “depends on the facts as they exist[ed] when the

complaint [was] filed.” Lujan v. Defenders of Wildlife, 504

U.S. 555, 569 n.4 (1992) (emphasis removed) (quoting

Newman-Green, Inc. v. Alfonzo-Larrain, 490 U.S. 826, 830

(1989)). We therefore look, not to the apparent risk of future

identity theft in, say, May 2014—the date of the first major

breach, see Arnold Plaintiffs’ Compl. ¶ 127, J.A. 73—but to

the risk apparent in March 2016, when Arnold Plaintiffs filed

their operative complaint.

Second, standing “must be supported in the same way as

any other matter on which the plaintiff bears the burden of

proof, i.e., with the manner and degree of evidence required at

the successive stages of the litigation.” Susan B. Anthony List

v. Driehaus, 573 U.S. 149, 158 (2014) (quoting Lujan, 504 U.S.

at 561). Thus, “at the motion to dismiss stage,” Arnold

Plaintiffs’ standing allegations must satisfy the pleading

requirements of Twombly and Iqbal—that is, the complaint

must state “‘a plausible claim’ that each element of standing is

3

satisfied.” Hancock v. Urban Outfitters, Inc., 830 F.3d 511,

513 (D.C. Cir. 2016) (quoting Iqbal, 556 U.S. at 678–79). This

standard “asks for more than a sheer possibility,” Iqbal, 556

U.S. at 678, that Arnold Plaintiffs faced a “substantial risk” that

future injury would occur, Susan B. Anthony List, 573 U.S. at

158 (quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398, 414

n.5 (2013)). Facts “that are ‘merely consistent with’” a

substantial risk of future identity theft fall “‘short of the line

between possibility and plausibility of ‘entitlement to relief.’”

Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 557).

Under these standards, most Arnold Plaintiffs lack

standing. This is not your typical case, where hackers break

into a commercial entity’s servers and steal consumer

information. In those cases, it is generally fair to infer—as this

court has inferred—that the hackers plan to, “sooner or later,”

“make fraudulent charges or assume [the victims’] identities.”

Attias v. Carefirst, Inc., 865 F.3d 620, 628–29 (D.C. Cir. 2017)

(quoting Remijas v. Neiman Marcus Grp., 794 F.3d 688, 693

(7th Cir. 2015)). “Why else would hackers break into a . . .

database and steal consumers’ private information?” Id. at 628

(alteration in original) (quoting Remijas, 794 F.3d 693). In

such cases there’s no obvious alternative explanation.

But here there is. In this case, hackers infiltrated a

government system and stole sensitive “government

investigation information,” Arnold Plaintiffs’ Compl. ¶ 1, J.A.

36, about government employees shortly after a cyberattack on

the same agency had “compromised critical security

documents,” id. ¶ 3, J.A. 37. It is thus fair to infer, as the

majority quite rightly recognizes, that the hackers “might well

[have been] motivated by a purpose other than identity theft,”

Maj. op. 17, such as obtaining secret information from the

persons in the files by extortion or surveillance, enlisting them

as agents, obtaining leverage over American businesses, or

4

otherwise jeopardizing U.S. national security, see Br. of

Chamber of Commerce of U.S. as Amicus Curiae in Support of

Appellees 6; cf. Arnold Plaintiffs’ Compl. ¶ 1, J.A. 36

(explaining that exposed and stolen information includes

“private facts collected in federal background and security

clearance investigations”); see also id. ¶ 129, J.A. 73–74

(specifying that the theft covered “many million questionnaire

forms containing highly sensitive personal, family, financial,

medical, and associational information”). This espionage

motive is, as Iqbal and Twombly put it, an “obvious alternative

explanation”—an explanation that Arnold Plaintiffs, to survive

a motion to dismiss, must deflect. Iqbal, 556 U.S. at 682

(quoting Twombly, 550 U.S. at 567).

This they fail to do. Just as “parallel conduct” in Twombly

“does not suggest conspiracy” in antitrust cases because it is

consistent with “independent action” in competitive markets,

Twombly, 550 U.S. at 556–57; and just as detention of

“thousands of Arab Muslim men” in Iqbal does not suggest

discrimination because (given the identity of the September

11th attackers) it is consistent with legitimate law enforcement

activity, Iqbal, 556 U.S. at 681–82, so too a “cyberattack on a

government system” does not suggest identity theft (of the type

alleged by plaintiffs) because it is consistent with an obvious

alternative explanation—foreign espionage, Maj. op. 17; see

also Beck v. McDonald, 848 F.3d 262, 274 (4th Cir. 2017)

(finding no standing based on a “risk of future identity theft”

where there is no evidence that the thief stole the laptop “with

the intent to steal [plaintiffs’] private information”).

What of dual motives, asks the majority? Couldn’t the

hackers have been interested in espionage and identity theft?

Maj. op. 18. Yes, that’s conceivable. But does the

conceivability actually render plaintiffs’ theory plausible? I

don’t think so. The majority invokes a syllogism: Because

5

“espionage and identity theft are not mutually exclusive,” it

follows that ascribing an “espionage-related motive” doesn’t

“render[] implausible” an allegation of “future risk of identity

theft and financial fraud” caused by the data breach. Id. But it

does exactly that. To begin with, even if the alternative

explanations in Iqbal and Twombly happened to be mutually

exclusive with plaintiffs’ theories, the Court has never

suggested that mutual exclusivity is a prerequisite to one

plausible explanation’s rendering some other explanation

implausible. This case shows why such a prerequisite would

be overkill. Just because two states of affairs can co-occur

doesn’t make their co-occurrence plausible—the legal standard

plaintiffs must clear—nor does an otherwise implausible

theory get bootstrapped into a plausible one merely because it’s

conceivable that it could co-occur with an obvious alternative

explanation.

So while a foreign government might theoretically have

enlisted “sophisticated” hackers to execute a “massive”

cyberattack on the U.S. government over the course of “several

months” to steal highly “sensitive” information, Maj. op. at 21,

both to (i) compromise U.S. national security and (ii) commit

fraud by (for example) purchases through an unauthorized Best

Buy account (Arnold Plaintiffs’ Compl. ¶ 39, J.A. 54), this

dual-motive hypothesis seems fanciful for at least two reasons.

First, the goal of identity theft is financial gain. The notion that

a foreign state pursuing a complex, risky, and possibly

expensive cyberespionage scheme would have as even one of

its goals the extraction of small-potatoes sums from individuals

by, e.g., filing fraudulent returns with the United States IRS or

creating a “My Social Security” account, see id. ¶ 14, J.A. 40–

41, falls far short of plausibility. Second, and more important,

a foreign power seeking leverage over the United States would

be most unlikely to permit its agents to use or sell the data for

identity theft purposes, as doing so would risk sabotaging the

6

espionage goal. If data gleaned from the hack is slated for

counterintelligence use, identity theft would undercut this aim

by alerting victims and causing them to alter their data. Since

the expected value of successful counterintelligence likely far

exceeds that of identity theft, an espionage explanation

affirmatively suggests that identity theft will not co-occur. And

that is precisely what the record suggests. There is, as

discussed below, a striking dearth of allegations as to any

pattern of unusual or higher-than-ordinary identity theft or

fraud among Arnold Plaintiffs. What readily comes to mind is

an obvious alternative explanation—hacking focused entirely

on pursuit of espionage and kindred threats to national security.

Thus the Sixth Circuit’s caution—that “[f]erreting out the

most likely reason for the defendants’ actions is not appropriate

at the pleadings stage,” Watson Carpet & Floor Covering, Inc.

v. Mohawk Industries, Inc., 648 F.3d 452, 458 (6th Cir.

2011)—is inapt here. The court states in the immediately

preceding sentence: “Often, defendants’ conduct has several

plausible explanations.” Id. (emphasis added). Sorting out

which among them is “most likely” is, indeed, out of bounds at

the pleadings stage. Yet the whole thrust of my argument is

that we haven’t got “several plausible explanations.” We have

one alleged theory—identity theft—that, I argue, is not

plausible in view of an obvious alternative explanation of far

greater probability. Though it’s unimpeachable logic to say

that “[t]he plausibility of [one particular] reason for the refusals

to sell carpet does not render all other reasons implausible,” id.,

the point—made in context of a discussion of “several

plausible explanations”—is not at play here, and marshaling it

only begs the question whether identity theft is, in fact, a

plausible explanation.

More is needed to “nudge[]” Arnold Plaintiffs’ identity

theft claims “across the line from conceivable to plausible.”

7

Iqbal, 556 U.S. at 680 (quoting Twombly, 550 U.S. at 570).

That is especially true here given the passage of time. As the

initial breach occurred nearly two years before Arnold

Plaintiffs filed their operative complaint, one would expect to

see—if plaintiffs were right about the hackers’ motives—some

allegation linking Arnold Plaintiffs as a whole to the breach—

such as indications that persons in the OPM databases suffered

a relatively high rate of identity thefts, or a pattern of similar

thefts. But there are no such allegations. And “‘as the breaches

fade further into the past,’ the Plaintiffs’ threatened injuries

become more and more speculative.” Beck, 848 F.3d at 275

(quoting Chambliss v. Carefirst, Inc., 189 F. Supp. 3d 564, 570

(D. Md. 2016)).

The majority generally agrees, conceding that the “passage

of two years in a run-of-the-mill data breach might, absent

allegation of subsequent data misuse, suggest that a claim of

future injury is less than plausible.” Maj. op. 21. Yet my

colleagues think such an inference is not fair game here, where

the breach occurred on “a massive scale” reflecting “a

relatively new phenomenon.” Id. Large-scale hacking is no

doubt a recent phenomenon. But I can think of no attributes of

such phenomena or their possible novelty that would invalidate

a common sense expectation that future identity-theft-type

injuries will become less plausible as time drags on without

result. Whatever else may be true, if identity theft is an

operative motive, time remains of the essence, given that much

personal data—credit card numbers, bank account information,

addresses—can go stale with time. If anything, the special

features of this case make the passage of time exceptionally

forceful in undermining plaintiffs’ theory. The extraordinary

volume of people affected and the exceptional sensitivity and

range of the information captured should make it relatively

easy to discern a “pattern of identity theft or financial fraud”

among the pool of 21.5 million potential victims (and

8

litigants)—if there is one. Id. And yet, as the majority agrees,

we have no “clearly identifiable pattern of identity theft or

financial fraud” in the Complaint. Id.

To be sure, “certain Arnold Plaintiffs have already had

fraudulent accounts opened and tax returns filed in their

names.” Maj. op. 19. But that is hardly probative. “In a society

where around 3.3% of the population will experience some

form of identity theft” in a given year, it is “not surprising” that

a few plaintiffs in a putative class of 21.5 million would “have

experienced some form of credit or bank-account fraud.” In re

U.S. Office of Personnel Mgmt. Data Sec. Breach Litig., 266 F.

Supp. 3d 1, 38 (D.D.C. 2017) (quoting In re Science

Applications Int’l Corp. Backup Tape Data Theft Litig., 45 F.

Supp. 3d 14, 32 (D.D.C. 2014)). A handful of Arnold

Plaintiffs, for instance, almost certainly experienced a home

invasion since the data breach. But that doesn’t imply a

“substantial risk” that these hackers have plans to break into

the homes of garden-variety government employees.

In sum, Arnold Plaintiffs have alleged no facts—

disproportionate incidence of identity theft, a distinctive

pattern of fraud, or anything else of that sort among the putative

class—that can credibly nudge their theory into the realm of

plausibility in the face of an obvious alternative explanation.

So they cannot “all” meet the threshold requirement for

standing under the pleading standards of Iqbal and Twombly.

Maj. op. 14.

I grant, of course, that in the immediate aftermath of the

cyber-intrusion, some putative class members might

reasonably have been unwilling to assume that the attack was

motivated by a purpose other than identity theft. Thus,

individuals at that early time, before the paucity of identity

theft data emerged, might have “reasonably spent money to

9

protect themselves” from identity theft and thus have a

plausible claim to standing to recover their expenses. Attias,

865 F.3d at 629. But that says nothing about whether, when

plaintiffs filed their operative complaint two years later, all

21.5 million putative class members could still “reasonably”

fear “a substantial risk” of identity theft. Id. at 629. They have

shown no such thing.

* * *

For the subset of Arnold Plaintiffs who, as I see it, have

standing, I turn to the issue of sovereign immunity. Arnold

Plaintiffs file a battery of state law claims against a contractor

that OPM engaged to perform background checks of

prospective federal employees. That contractor, KeyPoint

Government Solutions, Inc., maintains that, as a government

contractor, it is entitled to sovereign immunity. The court,

however, disagrees, see Maj. op. Part IV—and I join that part

of the opinion in full.

I write separately to address an important distinction

between contractor immunity, which KeyPoint asserts, and

federal preemption, which KeyPoint fails to raise, and about

which the court therefore expresses no views. See, e.g.,

KeyPoint’s Br. 25 (distinguishing between preemption and

immunity); Oral Arg. Tr. 31:3–21 (same); see also

Cunningham v. Gen. Dynamics Info. Tech., Inc., 888 F.3d 640,

646 n.4 (4th Cir. 2018) (same); In re KBR, Inc., Burn Pit Litig.,

744 F.3d 326, 342 n.6 (4th Cir. 2014) (same). Contractor

immunity, it seems to me, immunizes only those acts that

agents of the government are expressly directed by the

government to perform—such as building a particular dike as

“directed by the Government of the United States.” See, e.g.,

Yearsley v. W.A. Ross Construction Co., 309 U.S. 18, 20

(1940). Preemption, in contrast, is broader, knocking aside

10

state tort law to the extent that it impermissibly interferes with

a contractor’s ability to perform its federal obligations.

As the Supreme Court explained in Boyle v. United

Technologies Corp., there are “a few areas, involving ‘uniquely

federal interests,’” that “are so committed by the Constitution

and laws of the United States to federal control that state law is

pre-empted and replaced, where necessary, by federal law.”

487 U.S. 500, 504 (1988) (quoting Texas Industries, Inc. v.

Radcliff Materials, Inc., 451 U.S. 630, 640 (1981)). The “civil

liabilities arising out of the performance of federal procurement

contracts” is one of them. Id. at 505–06. That is because “the

Federal Government’s interest in the procurement of

equipment is implicated by” state tort suits, even where, as

here, “the dispute is one between private parties.” Id. at 506.

Specifically, the “imposition of liability on Government

contractors will directly affect the terms of Government

contracts: either the contractor will decline to manufacture the

design specified by the Government, or it will raise its price.

Either way, the interests of the United States will be directly

affected.” Id. at 507.

To protect these interests, state law may be “displace[d].”

Id. at 507. This will occur only where “a ‘significant conflict’

exists between an identifiable ‘federal policy or interest and the

[operation] of state law,’” id. (alteration in original) (quoting

Wallis v. Pan Am. Petroleum Corp., 384 U.S. 63, 68 (1966)),

“or the application of state law would ‘frustrate specific

objectives’ of federal legislation,” id. (quoting United States v.

Kimbell Foods, Inc., 440 U.S. 715, 728 (1979)). “In some

cases, for example where the federal interest requires a uniform

rule, the entire body of state law applicable to the area conflicts

and is replaced by federal rules.” Id. at 508 (citing Clearfield

Trust Co. v. United States, 318 U.S. 363, 366–67 (1943)). “In

others, the conflict is more narrow, and only particular

11

elements of state law are superseded.” Id. (citing United States

v. Little Lake Misere Land Co., 412 U.S. 580, 595 (1973)).

Here, there is a plausible argument for preemption. This

case involves a fundamental federal issue—the hiring, vetting,

and protecting of federal employees, and the balancing of the

costs of keeping the relevant data secure against the costs of

error or neglect in providing that security. And Congress, it

seems, has already created a detailed statutory scheme in the

form of the Privacy Act to address these (and other) issues.

See, e.g., 5 U.S.C. § 552a(e)(10) (requiring “appropriate . . .

technical . . . safeguards”). Under that scheme, the agency

must, by contract, “cause the requirements of [the Privacy Act]

to be applied” to the contractor’s “system of records,” see 5

U.S.C. § 552a(m)(1)—and if the agency fails to do so, then it

faces potential liability, see id. § 552a(g)(1)(D); see also 48

C.F.R. § 24.102(d) (“Agencies, which within the limits of their

authorities, fail to require that systems of records on individuals

operated on their behalf under contracts be operated in

conformance with the Act may be civilly liable to individuals

injured as a consequence of any subsequent failure to maintain

records in conformance with the Act.”). Allowing 50 states to

pile on and impose liability on contractors, with the financial

consequences falling back on federal agencies in contract

negotiations as the Boyle Court foresaw, might be found to

upset the balance intended by Congress.

KeyPoint, however, has not argued for preemption—only

for sovereign immunity. So, while it may press these

arguments at future stages of litigation, we need not resolve the

issue now.

* * *

12

This brings me to a final issue—the propriety of five

plaintiffs proceeding under pseudonyms. Although some of

our sister circuits take the view that a court of appeals has no

jurisdiction over plaintiffs who “fail[] to request permission

from the district court before proceeding anonymously,”

W.N.J. v. Yocom, 257 F.3d 1171, 1172 (10th Cir. 2001); accord,

e.g., United States ex rel. Little v. Triumph Gear Systems, Inc.,

870 F.3d 1242, 1249–50 (10th Cir. 2017); Citizens for a Strong

Ohio v. Marsh, 123 F. App’x 630, 636–37 (6th Cir. 2005);

Nat’l Commodity & Barter Ass’n v. Gibbs, 886 F.2d 1240,

1245 (10th Cir. 1989) (per curiam), that doctrine, if adopted by

us (which it has not been), would not change our handling of

this appeal’s merits—given the presence of other, non-

pseudonymous plaintiffs. Moreover, the five anonymous

plaintiffs in this case, see Arnold Plaintiffs’ Compl. ¶¶ 22–26,

J.A. 44–48, offer reasons that seem highly likely to prove

worthy of district court permission—once they request it. But

because pseudonymous filing impinges on values key to fair

adjudication and a free society, it is hard to see how the district

court on remand can avoid the issue once it has been noticed.

Although pseudonymous plaintiffs were once a rarity,

there appears now to be a trend permitting adult plaintiffs to

litigate incognito, with little more than pro-forma gatekeeping,

if any, by the district courts—even though the practice is

aberrant from the perspective of core constitutional and rule of

law norms, not to mention the federal rules of procedure.

Under the “customary and constitutionally-embedded

presumption of openness” that inheres in the nature of an

Anglo-American trial, those who invoke the state’s coercive

apparatus must do so openly, i.e., under “their real names.”

United States v. Microsoft Corp., 56 F.3d 1448, 1464 (D.C. Cir.

1995) (citations omitted); accord, e.g., Doe v. Blue Cross &

Blue Shield United, 112 F.3d 869, 872 (7th Cir. 1997) (Posner,

13

J.) (“The people have a right to know who is using their

courts.”). For good reason. Public openness may “cause all

trial participants to perform their duties more conscientiously,”

“induce unknown witnesses to come forward with relevant

testimony,” Gannett Co. v. DePasquale, 443 U.S. 368, 383

(1979), and generally foster “an appearance of fairness, thereby

heightening respect for the judicial process,” Globe Newspaper

Co. v. Superior Court for Norfolk Cnty., 457 U.S. 596, 606

(1982), cf. Richmond Newspapers, Inc. v. Virginia, 448 U.S.

555, 569–73 (1980) (explaining importance of openness in

criminal trial context). Of course, it’s less important that

respect for the judicial process be “heighten[ed]” than that it be

deserved, which is less likely if plaintiffs can routinely act

anonymously. In short, public scrutiny is essential to “the

integrity of judicial proceedings.” Metlife, Inc. v. Fin. Stability

Oversight Council, 865 F.3d 661, 665 (D.C. Cir. 2017)

(quoting United States v. Hubbard, 650 F.2d 293, 315 (D.C.

Cir. 1980)).

Indeed, it is a matter of “[b]asic fairness.” Microsoft, 56

F.3d at 1463 (quoting Southern Methodist Univ. Ass’n of

Women Law Students v. Wynne & Jaffe, 599 F.2d 707, 713 (5th

Cir. 1979)). A case brought anonymously can let a winning

plaintiff inflict “disgrace” on a defendant and can let a losing

plaintiff launch defamatory charges “without shame or

liability,” Doe v. Smith, 429 F.3d 706, 710 (7th Cir. 2005); see

also Wynne, 599 F.2d at 713; even in situations less drastic than

Doe v. Smith, allowance of anonymity creates a structural

asymmetry that can tilt the scales unfairly. If defendants get

named, plaintiffs should too.

The principle of openness is far from an “arcane relic of

ancient English law.” Hubbard, 650 F.2d at 315 n.79 (citation

omitted). Rule 10(a) of the civil rules says straightforwardly

that the “title of [a] complaint must name all the parties.” Fed.

14

R. Civ. P. 10(a) (emphases added). Perhaps “name” might be

taken to mean something like “real or fictitious name.” Cf.

Carol M. Rice, Meet John Doe: It Is Time for Federal Civil

Procedure to Recognize John Doe Parties, 57 U. Pitt. L. Rev.

883, 914–15 (1996) (denying that Rule 10(a) bars anonymous

filings). This reading is questionable, not least because it

appears to prove too much—it would mean that plaintiffs may

proceed anonymously as of right, obviating a need for judicial

approval or balancing, as discussed below. And Rule 10(a)

contains no exception “for good cause,” which features in

many other contexts. See, e.g., Fed. R. Civ. P. 5(d)(3)(A),

6(c)(1)(C), 16(b)(4), 31(a)(5), 43(a); see also Triumph Gear,

870 F.3d at 1249 (stating that the federal rules “make no

provision for suits by persons using fictitious names or for

anonymous plaintiffs” (quoting Commodity & Barter Ass’n,

886 F.2d at 1245)); cf. McKeever v. Barr, 920 F.3d 842, 845

(D.C. Cir. 2019) (holding that when a rule of criminal

procedure says “must,” and provides no “residual exception,”

as the rules do elsewhere, the district court has no inherent

power to create its own “exceptions”).

Following our sister circuits, we’ve said in dictum that—

even though anonymous filing is “an extraordinary break with

precedent,” Microsoft, 56 F.3d at 1464—a district court has

discretion to “grant the ‘rare dispensation’ of anonymity

against the world,” id. (quoting James v. Jacobson, 6 F.3d 233,

238 (4th Cir. 1993)); cf. Doe v. Frank, 951 F.2d 320, 323 (11th

Cir. 1992) (“It is the exceptional case in which a plaintiff may

proceed under a fictitious name.”). But, we explained, this

“rare dispensation” can be granted only after the district court

has conducted an inquiry into whether the circumstances justify

an “extraordinary break” with the normal method of

proceeding—openly—in federal court. Microsoft, 56 F.3d at

1464.

15

Anonymity for “rare” or “extraordinary” cases doesn’t

appear to be an apt description of current practice. Cf., e.g.,

Coe v. Cnty. of Cook, 162 F.3d 491, 498 (7th Cir. 1998)

(Posner, J.) (criticizing the “overuse of pseudonyms in federal

litigation”). Consider that in the twenty-five-year period

between 1945 and 1969, only a single district court decision—

anywhere in the country—featured a “John Doe”-like plaintiff

as the lead or sole plaintiff (along with a single Supreme Court

case reviewing a state court decision and three appellate rulings

in administrative appeals). Adam A. Milani, Doe v. Roe: An

Argument for Defendant Anonymity When a Pseudonymous

Plaintiffs Alleges a Stigmatizing Intentional Tort, 41 Wayne L.

Rev. 1659, 1660 (1995); see also Joan Steinman, Public Trial,

Pseudonymous Parties, 37 Hastings L.J. 1, 1 n.2 (1985). And

in the fifty years since that time, we have never “expressly

condoned [the] practice.” Qualls v. Rumsfeld, 228 F.R.D. 8, 9

(D.D.C. 2005). Yet there are now “two different but analogous

tests . . . applied in this circuit” to rule on anonymity requests,

John Doe Co. v. Consumer Fin. Prot. Bureau, 321 F.R.D. 31,

33 (D.D.C. 2017)—a six-factor test drawn from United States

v. Hubbard, 650 F.2d 293, 317–21 (D.C. Cir. 1980), and a five-

factor test elaborated in National Association of Waterfront

Employers v. Chao, 587 F. Supp. 2d 90, 99 (D.D.C. 2008). Just

last year, in this district alone, at least six published district

court decisions featured “John Doe” as the lead or sole

plaintiff. 1 That is to say nothing of the twenty or so other

orders that permitted Doe and the like to (anonymously) level

1

See Doe 2 v. Trump, 315 F. Supp. 3d 474 (D.D.C. 2018), rev’d

on other grounds sub nom. Doe 2 v. Shanahan, 755 F. App’x 19

(D.C. Cir. 2019); Doe 1 v. Buratai, 318 F. Supp. 3d 218 (D.D.C.

2018); Doe v. George Washington Univ., 305 F. Supp. 3d 126

(D.D.C. 2018); Doe 1 v. FCC, 302 F. Supp. 3d 160 (D.D.C. 2018);

Doe v. Mattis, 288 F. Supp. 3d 195 (D.D.C. 2018); Does 1–144 v.

Chiquita Brands Int’l, Inc., 285 F. Supp. 3d 228 (D.D.C. 2018).

16

accusations against others; many of those orders were sealed 2

or lacked any reasoning at all (thereby omitting the “inquiry”

required by Microsoft). 3 But cf., e.g., EEOC v. Nat’l

Children’s Center, Inc., 98 F.3d 1406, 1410 (D.C. Cir. 1996)

(“[I]t is imperative that a district court articulate its reasons for

electing to seal or not to seal a record.”).

Proceedings in this case appear to have gone yet further

down the slope of anonymity. Here, five “Does” not only filed

anonymously; they evidently never even bothered to ask the

district court for permission to do so. The “docket sheet does

not reflect any motion or proceeding dealing with whether”

John Does I–III or Jane Does I–II “could proceed under

pseudonyms.” Marsh, 123 F. App’x at 636–37. In their

amended Complaint the anonymous plaintiffs simply

announce, in present participle form, that (for example) John

Doe II “is using” a pseudonym “because of his personal safety

concerns,” as if such a cursory and conclusory statement

suffices as belated justification in lieu of a court’s permission.

Arnold Plaintiffs’ Compl. ¶ 25, J.A. 46. That simply cannot

2

See Zelda v. Sessions, No. 1:18-cv-1966 (D.D.C. Aug. 22,

2018), ECF No. 2; Voe v. Mattis, No. 1:18-cv-1251 (D.D.C. June 6,

2018), ECF Nos. 8–9; Kurd v. Repub. of Turkey, No. 1:18-cv-1117

(D.D.C. May 11, 2018), ECF No. 4; Doe A-1 v. Democratic People’s

Repub. of Korea, No. 1:18-cv252 (D.D.C. Feb. 1, 2018), ECF No. 3.

3

See Garcia Ramirez v. ICE, No. 1:18-cv-508 (D.D.C. Aug, 30,

2018) (minute order); Dora v. Sessions, No. 1:18-cv-1938 (D.D.C.

Aug. 17, 2018), ECF No. 2; Usoyan v. Repub. of Turkey, No. 1:18-

cv-1141 (D.D.C. May 15, 2018), ECF No. 5; Damus v. Nielsen, No.

1:18-cv-578 (D.D.C. Mar. 15, 2018), ECF No. 2; Doe v. Kettler

Mgmt., Inc., No. 1:18-cv-585 (D.D.C. Mar. 15, 2018), ECF No. 3;

Doe v. George Washington Univ., No. 1:18-cv-553 (D.D.C. Mar. 8,

2018), ECF No. 2; Doe v. Kipp DC Supporting Corp., No. 1:18-cv-

260 (D.D.C. Feb. 2, 2018), ECF No. 2; Doe v. Syrian Arab Repub.,

No. 1:18-cv-66 (D.D.C. Jan. 11, 2018), ECF No. 2.

17

square with the federal rules or our longstanding commitment

to openness, much less the rule referred to earlier of treating

failure to request permission as fatal to jurisdiction over such

parties.

On remand, then, the district court should consider the

substantive and procedural questions relating to the Does’

status in the lawsuit.