Federal employees are seeking a temporary restraining order as part of a class action lawsuit accusing a group of Elon Musk’s associates of allegedly operating an illegally connected server from the fifth floor of the US Office of Personnel Management’s (OPM) headquarters in Washington, DC.
An attorney representing two federal workers—Jane Does 1 and 2—filed a motion this morning arguing that the server’s continued operation not only violates federal law but is potentially exposing vast quantities of government staffers’ personal information to hostile foreign adversaries through unencrypted email.
A copy of the motion, filed in the DC District Court by National Security Counselors, a Washington-area public-interest law firm, was obtained by WIRED exclusively in advance. WIRED previously reported that Musk had installed several lackeys in OPM’s top offices, including individuals with ties to xAI, Neuralink, and other companies he owns.
The initial lawsuit, filed on January 27, cites reports that Musk’s associates illegally connected a server to a government network for the purposes of harvesting information, including the names and email accounts of federal employees. The server was installed on the agency’s premises, the complaint alleges, without OPM—the government’s human resources department—conducting a mandatory privacy impact assessment required under federal law.
Under the 2002 E-Government Act, agencies are required to perform privacy assessments prior to making “substantial changes to existing information technology” when handling information “in identifiable form.” Notably, prior to the installation of the server, OPM did not have the technical capability to email the entire federal workforce from a single email account.
“[A]t some point after 20 January 2025, OPM allowed unknown individuals to simply bypass its existing systems and security protocols,” Tuesday’s motion claims, “for the stated purpose of being able to communicate directly with those individuals without involving other agencies. In short, the sole purpose of these new systems was expediency.”
OPM did not immediately respond to a request for comment.
Got a Tip?
Are you a current or former employee with a government agency impacted by this? We’d like to hear from you. Using a nonwork phone or computer, contact Dell Cameron securely at dell.3030 on Signal.
If the motion is granted, OPM would be forced to disconnect the server until the assessment is done. As a consequence, the Trump administration’s plans to drastically reduce the size of the federal workforce would likely face delays. The email account linked to the server—HR@opm.gov—is currently being used to gather information from federal workers accepting buyouts under the admin’s “deferred resignation program,” which is set to expire on February 6.
“Under the law, a temporary restraining order is an extraordinary remedy,” notes National Security Counselors’ executive director, Kel McClanahan. “But this is an extraordinary situation.”
Before issuing a restraining order, courts apply what’s known as the “balance of equities” doctrine, weighing the burdens and costs on both parties. In this case, however, McClanahan argues that the injunction would inflict “no hardship” on the government whatsoever. February 6 is an “arbitrary deadline,” he says, and the administration could simply continue to implement the resignation program “through preexisting channels.”
“We can’t wait for the normal course of litigation when all that information is just sitting there in some system nobody knows about with who knows what protections,” McClanahan says. “In a normal case, we might be able to at least count on the inspector general to do something, but Trump fired her, so all bets are off.”
The motion further questions whether OPM violated the Administrative Procedure Act, which prohibits federal agencies from taking actions “not in accordance with the law.” Under the APA, courts may “compel agency action”—such as a private assessment—when it is “unlawfully withheld.”
Employees at various agencies were reportedly notified last month to be on the lookout for messages originating from the HR@opm.gov account. McClanahan’s complaint points to a January 23 email from acting Homeland Security secretary Benjamine Huffman instructing DHS employees that the HR@opm.gov account “can be considered trusted.” In the following days, emails were blasted out twice across the executive branch instructing federal workers to reply “Yes” in both cases.
The same account was later used to transmit the “Fork in the Road” missive promoting the Trump administration’s legally dubious “deferred resignation program,” which claims to offer federal workers the opportunity to quit but continue receiving paychecks through September. Workers who wished to participate in the program were instructed to reply to the email with “Resign.”
As WIRED has reported, even the new HR chief of DOGE, Musk’s task force, was unable to answer basic questions about the offer.
The legal authority underlying the program is unclear, and federal employee union leaders are warning workers not to blindly assume they will actually get paid. In a floor speech last week, Senator Tim Kaine advised workers not to be fooled: “There’s no budget line item to pay people who are not showing up for work.” Patty Murray, ranking Democrat on the Senate Appropriations Committee, similarly warned Monday: “There is no funding allocated to agencies to pay staff for this offer.”
McClanahan’s lawsuit highlights the government’s response to the OPM hack of 2015, which compromised personnel records on more than 22 million people, including some who’d undergone background checks to obtain security clearances. A congressional report authored by House Republicans following the breach pinned the incident on a “breakdown in communications” between OPM’s chief information officer and its inspector general: “The future effectiveness of the agency’s information technology and security efforts,” it says, “will depend on a strong relationship between these two entities moving forward.”
OPM’s inspector general, Krista Boyd, was fired by President Donald Trump in the midst of the “Friday night purge” on January 24—one day after the first HR@opm.gov email was sent.
“We are witnessing an unprecedented exfiltration and seizure of the most sensitive kinds of information by unelected, unvetted people with no experience, responsibility, or right to it,” says Sean Vitka, policy director at the Demand Progress Education Fund, which is supporting the action. “Millions of Americans and the collective interests of the United States desperately need emergency intervention from the courts. The constitutional crisis is already here.”