Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Government Privacy

OPM Sued Over Privacy Concerns With New Government-Wide Email System (thehill.com) 40

An anonymous reader quotes a report from the Hill: Two federal employees are suing the Office of Personnel Management (OPM) to block the agency from creating a new email distribution system -- an action that comes as the information will reportedly be directed to a former staffer to Elon Musk now at the agency. The suit (PDF), launched by two anonymous federal employees, ties together two events that have alarmed members of the federal workforce and prompted privacy concerns. That includes an unusual email from OPM last Thursday reviewed by The Hill said the agency was testing "a new capability" to reach all federal employees -- a departure from staffers typically being contacted directly by their agency's human resources department.

Also cited in the suit is an anonymous Reddit post Monday from someone purporting to be an OPM employee, saying a new server was installed at their office after a career employee refused to set up a direct line of communication to all federal employees. According to the post, instructions have been given to share responses to the email to OPM chief of staff Amanda Scales, a former employee at Musk's AI company. Federal agencies have separately been directed to send Scales a list of all employees still on their one-year probationary status, and therefore easier to remove from government. The suit says the actions violate the E-Government Act of 2002, which requires a Privacy Impact Assessment before pushing ahead with creation of databases that store personally identifiable information.

Kel McClanahan, executive director of National Security Counselors, a non-profit law firm, noted that OPM has been hacked before and has a duty to protect employees' information. "Because they did that without any indications to the public of how this thing was being managed -- they can't do that for security reasons. They can't do that because they have not given anybody any reason to believe that this server is secure.that this server is storing this information in the proper format that would prevent it from being hacked," he said. McClanahan noted that the emails appear to be an effort to create a master list of federal government employees, as "System of Records Notices" are typically managed by each department. "I think part of the reason -- and this is just my own speculation -- that they're doing this is to try and create that database. And they're trying to sort of create it by smushing together all these other databases and telling everyone who receives the email to respond," he said.

OPM Sued Over Privacy Concerns With New Government-Wide Email System

Comments Filter:
  • by jrnvk ( 4197967 ) on Tuesday January 28, 2025 @08:29PM (#65126657)
    Not sure how controversial those are, at least until someone accidentally hits reply all
    • by laughingskeptic ( 1004414 ) on Wednesday January 29, 2025 @09:41AM (#65127729)
      No one stands up a compliant server for anything in the U.S. government in one day. This means no security controls on the server were validated, that required anti-virus software is not licensed and installed, etc. And they just sent the IP address of this system in the email headers to every U.S. government employee so it is being targeted today. This is what is controversial: that some people from outside the org showed up with a box, plugged it into the network, loaded up the email addresses of 2.3 million employees and went to town. This the first recipe in recipe book for "How To Be Hacked" stew.
  • by registrations_suck ( 1075251 ) on Tuesday January 28, 2025 @08:48PM (#65126675)

    Employees complain that an organization wants to send email to all employees.

    Really? I mean, come on man.

    It's semi-shocking that this capability wasn't created, I dunno, 20 years ago?

    As a federal employee, I am not bothered in the slightest by such a capability.

    As for the "reply all" problem, that is easily solved.

    • Re: (Score:1, Informative)

      by quonset ( 4839537 )

      Right. An unsecured server handed over to the friend of an oligarch who doesn't have any clearance to access such information.

      Sure, nothing wrong with that at all.

      • by butlerm ( 3112 )

        The President of the United States can grant clearance necessary for someone to do their job or advise him properly at any time and for almost any reason because under the Constitution the executive power of the United States including all federal agencies is vested in him. He does have to see that the law is faithfully executed but there are limits to the degree of control Congress can exercise over the President under separation of powers and this is one of them. The president can share information with

        • Not to mention that the govt can create a system to email all employees without providing info to anyone. I mean, jezz.

        • Re: (Score:1, Insightful)

          by Anonymous Coward

          The president can share information with anyone he wants...

          Oh, he has. Just ask to see his "special classified briefing documents" and for a small donation he'll take you to Mar Largo and show you all sorts of things, laws be damned.

      • Who said it was unsecured? The complaint seems to be that there hasn't been enough red tape involved, not that it was unsecured. And the person in charge of it is a government employee. And who said they weren't cleared for access? Is a list of internal email addresses so sensitive that a ranking official can't see it?

        These things you claim seem very silly to me.

      • Right. An unsecured server handed over to the friend of an oligarch who doesn't have any clearance to access such information.

        Sure, nothing wrong with that at all.

        Lousy, unaccountable email servers are a feature of the GOP [arstechnica.com], not a bug.

  • National Archives (Score:5, Interesting)

    by bill_mcgonigle ( 4333 ) * on Tuesday January 28, 2025 @08:57PM (#65126687) Homepage Journal

    National Archives should be given control of backups so when an agency "accidentally deletes" backups when Congress launches an Investigation, the Archives can help out and save them from such embarrassment.

    They already handle classified archives so this should be doable and save a ton of money.

    I'm sure they were all accidents, right?

    • National Archives should be given control of backups so when an agency "accidentally deletes" backups when Congress launches an Investigation, the Archives can help out and save them from such embarrassment.

      They already handle classified archives so this should be doable and save a ton of money.

      I'm sure they were all accidents, right?

      My reflexive response is, haha, they will just use personal communications.
      https://en.wikipedia.org/wiki/... [wikipedia.org]
      https://en.wikipedia.org/wiki/... [wikipedia.org]

      Then I was relieved when I remembered we tried to fix this.
      https://en.wikipedia.org/wiki/... [wikipedia.org]

      But what does following the law mean today? Fuck it, just pardon the whole agency, what is Congress going to do, impeach, lololol. Use burner phones and cover your own ass, everyone look out for themselves, fuck laws, this is what we voted for. So good luck with that one Bill.

  • Attorneys attempt a class action based on complaints by two anonymous employees. Those two will be subpoenaed and will need to show unlawful harm. Big waste of taxpayer money in court to coddle career pensions paid by all Americans.
    • by nickovs ( 115935 ) on Wednesday January 29, 2025 @12:00AM (#65126925)
      They only need to show harm if they want damages. If they are just seeking an injunction to demand that the OPM follow the law (which clearly states that a privacy impact assessment is required) then they just have to show that the law was not followed.

      The solution is pretty easy: the OPM could do a PIA. The problem is that this is likely being put in place to spot âoesubversiveâ civil servants who donâ(TM)t sufficiently by in to the new regimeâ(TM)s agenda, so a PIA (which would need to be published) would be damning.

      • You are right about the lawsuit "prayer" asking for injunctive relief, and that a quick review to follow rule may be fastest resolution. The boilerplate "Grant such other relief as the Court may deem just and proper" is in there, so will watch this.
  • by couchslug ( 175151 ) on Tuesday January 28, 2025 @10:07PM (#65126763)

    Every party switch will require purging the internal enemies installed by previous regimes and neutrality won't save anyone.

    Eventually the armed forces will be affected which is a great way to turn into (r)ussia, but enlisted careers will be safer than officers.

    • Every party switch will require purging the internal enemies installed by previous regimes and neutrality won't save anyone.

      Eventually the armed forces will be affected which is a great way to turn into (r)ussia, but enlisted careers will be safer than officers.

      The armed forces have been affected at least since the officer candidate schools began asking whether the student would obey orders to disarm the US citizen civilians in an area. (If I recall correctly this was during the Obama administration.)

  • by necro81 ( 917438 ) on Wednesday January 29, 2025 @08:37AM (#65127505) Journal
    A personal friend is a federal judge. When this email from OPM came through last week it caused a bit of a stir, because:
    1) OPM has no jurisdiction over employees in the Judiciary. They are a separate, co-equal branch of government. As such, they have their own IT and personnel policies.
    2) It looked for all the world to be a crude phishing attack. Poor formatting and grammar, a hint of immediacy, the threat the bad consequences, combined with a "click here" hyperlink with obfuscation.

    Welcome to the wrecking crew. I've done enough renovation in my home, or refactoring substantial codebases, to know that you usually have to start by tearing things down. But usually that's done according to a thought-out plan, with a clear trajectory from the tear down to a better-built result. This just looks like some dumbass with a sledge hammer.
  • by necro81 ( 917438 ) on Wednesday January 29, 2025 @08:43AM (#65127521) Journal

    Two federal employees are suing the Office of Personnel Management (OPM) to block the agency from creating a new email distribution system -- an action that comes as the information will reportedly be directed to a former staffer to Elon Musk now at the agency

    For reference: the supposed DOGE office doesn't actually exist, because Trump can't just make a new federal department out of thin air without Congress. So, instead, he's squeezed DOGE into what was the United States Digital Service [npr.org] - the guys that fixed the healthcare.gov rollout.

    That "e-mail" and "Elon Musk" have similar initializations present so many opportunities.

    Elon-mail
    Musk-mail
    e-Musk

    All sound rather unpleasant.

  • has no idea how government works

It isn't easy being the parent of a six-year-old. However, it's a pretty small price to pay for having somebody around the house who understands computers.

Working...