Law.com Subscribers SAVE 30%
Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.
<b><i>Online Extra:</b></i> DOJ Wants Massive Government Data Breach Suits Consolidated
It was the worst data breach in the history of the U.S. government, and now the Justice Department says the ensuing lawsuits filed in six different jurisdictions belong in a single court in Washington, D.C.
On Oct. 1, the U.S. Judicial Panel on Multidistrict Litigation in New York was set to hear arguments on a motion filed in July by DOJ trial lawyers who want to coordinate what are now eight lawsuits pertaining to the massive data breach last summer at the U.S. Office of Personnel Management.
The first breach, announced on June 4, compromised the personnel files of more than 4 million current and former federal employees. A second hack compromised the personal information of more than 21 million people who applied for security clearances, including'judges'and judicial staff.
This month, the OPM awarded a $133 million contract to provide identity theft protection for those affected by the hacks.
A Justice Department spokeswoman declined to comment about the lawsuits.
Most of the lawsuits are class actions filed on behalf of current, former and prospective federal government employees, contractors and family members who, citing the reports of OPM's Office of the Inspector General, claim that the agency has been negligent since 2007 in failing to prevent cybersecurity hacks. They assert claims under the Privacy Act of 1974, which prohibits the disclosure of records maintained by government agencies, and the Administrative Procedure Act, which controls the way in which U.S. administrative agencies regulate. They seek damages for identify theft and costs tied to credit monitoring and frozen accounts.
One class action was brought by the American Federation of Government Employees, AFL-CIO, which represents about 650,000 government employees. Another labor union, the National Treasury Employees Union, which represents 150,000 federal workers, brought an individual case against former OPM director Katherine Archuleta, who'resignedon July 10 following several contentious hearings on Capitol Hill. NTEU is opposing consolidation with the other OPM cases.
'We have a single claim, a constitutional claim, based on the constitutional right to informational privacy, which is an amorphous right that is firmly established,' said Paras Shah, assistant general counsel at NTEU. 'The primary thing we want to have happen is for OPM to adequately secure its IT databases.'
The cases were brought in federal courts in the District of Columbia, Colorado, Kansas, Georgia, Idaho and California. Plaintiffs lawyers in the class actions have supported consolidation in the District of Columbia or Colorado, where another defendant, KeyPoint Government Solutions, the contractor that handled many of the background checks, is based in Loveland. Jason Mendro, a partner in the Washington office of Gibson, Dunn & Crutcher, who represents KeyPoint, did not respond to a request for comment.
One case was brought by Teresa McGarry, an administrative law judge in the Social Security Administration's Office of Disability Adjudication and Review in Jacksonville, Florida, who has had two background checks done. She also named the U.S. Department of Homeland Security, which was tasked with overseeing a program to detect cyberattacks of federal government databases.
The cases also name OPM Acting Director Beth Cobert; U.S. Ambassador to Australia John Berry, who was OPM director from 2009 to 2013; OPM Chief Information Officer Donna Seymour; and U.S. Court of Federal Claims Judge Elaine Kaplan, former OPM general counsel who served as the agency's acting director in the months before Archuleta came on board in 2013.
The MDL panel typically rules on consolidation motions a few weeks after its hearings.
Amanda Bronstad, The National Law Journal
'
It was the worst data breach in the history of the U.S. government, and now the Justice Department says the ensuing lawsuits filed in six different jurisdictions belong in a single court in Washington, D.C.
On Oct. 1, the U.S. Judicial Panel on Multidistrict Litigation in
The first breach, announced on June 4, compromised the personnel files of more than 4 million current and former federal employees. A second hack compromised the personal information of more than 21 million people who applied for security clearances, including'judges'and judicial staff.
This month, the OPM awarded a $133 million contract to provide identity theft protection for those affected by the hacks.
A Justice Department spokeswoman declined to comment about the lawsuits.
Most of the lawsuits are class actions filed on behalf of current, former and prospective federal government employees, contractors and family members who, citing the reports of OPM's Office of the Inspector General, claim that the agency has been negligent since 2007 in failing to prevent cybersecurity hacks. They assert claims under the Privacy Act of 1974, which prohibits the disclosure of records maintained by government agencies, and the Administrative Procedure Act, which controls the way in which U.S. administrative agencies regulate. They seek damages for identify theft and costs tied to credit monitoring and frozen accounts.
One class action was brought by the American Federation of Government Employees, AFL-CIO, which represents about 650,000 government employees. Another labor union, the National Treasury Employees Union, which represents 150,000 federal workers, brought an individual case against former OPM director Katherine Archuleta, who'resignedon July 10 following several contentious hearings on Capitol Hill. NTEU is opposing consolidation with the other OPM cases.
'We have a single claim, a constitutional claim, based on the constitutional right to informational privacy, which is an amorphous right that is firmly established,' said Paras Shah, assistant general counsel at NTEU. 'The primary thing we want to have happen is for OPM to adequately secure its IT databases.'
The cases were brought in federal courts in the District of Columbia, Colorado, Kansas, Georgia, Idaho and California. Plaintiffs lawyers in the class actions have supported consolidation in the District of Columbia or Colorado, where another defendant, KeyPoint Government Solutions, the contractor that handled many of the background checks, is based in Loveland. Jason Mendro, a partner in the Washington office of
One case was brought by Teresa McGarry, an administrative law judge in the Social Security Administration's Office of Disability Adjudication and Review in Jacksonville, Florida, who has had two background checks done. She also named the U.S. Department of Homeland Security, which was tasked with overseeing a program to detect cyberattacks of federal government databases.
The cases also name OPM Acting Director Beth Cobert; U.S. Ambassador to Australia John Berry, who was OPM director from 2009 to 2013; OPM Chief Information Officer Donna Seymour; and U.S. Court of Federal Claims Judge Elaine Kaplan, former OPM general counsel who served as the agency's acting director in the months before Archuleta came on board in 2013.
The MDL panel typically rules on consolidation motions a few weeks after its hearings.
Amanda Bronstad, The National Law Journal
'
Strategy vs. Tactics: Two Sides of a Difficult Coin
With each successive large-scale cyber attack, it is slowly becoming clear that ransomware attacks are targeting the critical infrastructure of the most powerful country on the planet. Understanding the strategy, and tactics of our opponents, as well as the strategy and the tactics we implement as a response are vital to victory.
'Huguenot LLC v. Megalith Capital Group Fund I, L.P.': A Tutorial On Contract Liability for Real Estate Purchasers
In June 2024, the First Department decided Huguenot LLC v. Megalith Capital Group Fund I, L.P., which resolved a question of liability for a group of condominium apartment buyers and in so doing, touched on a wide range of issues about how contracts can obligate purchasers of real property.
CoStar Wins Injunction for Breach-of-Contract Damages In CRE Database Access Lawsuit
Latham & Watkins helped the largest U.S. commercial real estate research company prevail in a breach-of-contract dispute in District of Columbia federal court.
The Article 8 Opt In
The Article 8 opt-in election adds an additional layer of complexity to the already labyrinthine rules governing perfection of security interests under the UCC. A lender that is unaware of the nuances created by the opt in (may find its security interest vulnerable to being primed by another party that has taken steps to perfect in a superior manner under the circumstances.