Case Summary and Outcome

A United States District Court issued a temporary restraining order preventing political appointees and “special government employees” from accessing financial systems and ordering the destruction of any information already accessed. Nineteen states had brought the urgent application after the introduction of a new policy giving the newly-created Department of Government Efficiency (DOGE) access to vast amounts of confidential financial and personal data and apparent powers to stop payments. The states argued that the policy violated various US laws and compromised the privacy of citizens’ and residents’ data, and that it threatened digital security and facilitated potential abuses, including the misuse of information for discriminatory or political purposes. The Court found that the states had a strong likelihood of success on the merits and met the requirements for the injunction.

Facts

On January 20, 2025, US President Donald J. Trump issued an executive order establishing the Department of Government Efficiency (“DOGE”), tasked with reducing public spending. Elon Musk, businessman and owner of X (formerly Twitter), was appointed head of DOGE.

On February 2, 2025, at the direction of the President and Secretary of the Treasury, the Department of the Treasury introduced a new policy which expanded access to Bureau of Fiscal Services (BFS) payment systems to political appointees and “special government employees” without requiring them to undergo the security checks mandated for career officials. Based on posts by Musk on X, “special government employees” appeared to refer to Musk’s “personal associates”. [Complaint para. 9]

The attorneys general of nineteen states – New York, Arizona, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, Nevada, New Jersey, North Carolina, Oregon, Rhode Island, Vermont, and Wisconsin – brought an application for an injunction. The states sought injunctive relief to prevent the Trump administration, through DOGE, from granting access to sensitive Treasury Department data to any individual who was not a career civil servant with the requisite security clearances and training in data protection. They also sought an order requiring the deletion of any information already obtained by unauthorized individuals since the implementation of the new policy. The states brought the case against President Trump and the Secretary of the Treasury, Scott Bessent.

Although there was no stated objective of the new policy, the states indicated that, “upon information and belief”, one purpose of the new policy was to “allow DOGE to advance a stated goal to block federal funds from reaching beneficiaries who do not align with the President’s political agenda”. [Complaint para. 5] They gave the example of DOGE freezing payments to the United States Agency for International Development (USAID) through its access to BFS. Musk published a series of posts on X which demonstrated this objective: on February 2, 2025, he said that DOGE is “rapidly shutting down … illegal payments” made to grant recipients, including to a church providing services to migrant children and, on February 6, 2025, he called for federal payments to “FRAUDULENT entities” to cease. [Complaint, para. 6]

Despite the Treasury saying that the DOGE associates had only “read-only” access to the BFS, Musk himself appeared to confirm that they had access to the system and could “shut-down” payments to federal grant recipients. [Complaint, para. 9]

In addition to the concern that the new policy enabled DOGE to block BFS payments based on political positions, the states also highlighted the cybersecurity risks the policy posed to their residents as it enabled the processing of residents’ personal information “unchecked, in a manner not permitted by federal law”. [Complaint, para. 10] The states also referred to reports that indicated that the personal information on the BFS is being “fed into an open-source Artificial Intelligence (‘AI’) system owned and controlled by a private third party without measures being taken to ensure the privacy and security of U.S. citizen’s and residents’ data”. [Complaint, para. 9] The states argued that “DOGE’s access of BFS records puts vast amounts of funding for States and their residents in peril and endangers the [personal information] of States’ residents whose information is stored on the payment systems”. [Complaint, para. 13]

On February 14, 2025, the US District Court, Southern District of New York, heard oral arguments. At this hearing some parties submitted additional documents. The Office of the Attorney General of the State of New York, Letitia James, filed supplemental agency materials: an order issued by Judge Amir H. Ali of the D.C. District Court in two related cases, AIDS Vaccine Advocacy Coalition v. U.S. Department of State USA, Civil Action No. 25-00400 (D.D.C.), and Global Health Council v. Donald J. Trump, Civil Action No. 25-00402 (D.D.C.). That Court had granted a preliminary injunction prohibiting the Department of State, USAID and the Office of Management and Budget from terminating any funding contracts issued by the USAID in connection with an executive order issued by President Trump which suspended federal funding for foreign assistance, pending a review consistent with that Executive Order.

Former Treasury Department officials filed an Amici Curiae brief in support of the states’ motion for preliminary injunctive relief. They argued that “DOGE access to or control over Bureau of the Fiscal Service systems raises serious concerns, including the risk that payments will be illegally stopped based on Musk’s or the Trump Administration’s own political or policy preferences, the possibility of severe cybersecurity and privacy breaches, and the potential that payments could be inadvertently delayed to millions of individuals, including retirees and veterans; to organizations and businesses providing public services on behalf of the federal government; and to states, localities, territories, and tribal nations providing services like Medicaid and transportation.” [Amici brief, p. 2]

On February 16, 2025, the US Department of Justice filed a brief informing the Court of a recent decision by the D.C. District Court in A.F.L.-C.I.O. et al. v. Department of Labor et al. denying a temporary restraining order against several government agencies, including the DOGE, restricting access to records containing personal information.

Decision Overview

Judge Paul A. Engelmayer of the United States District Court for the Southern District of New York heard the application for injuctive relief. The central issue for the Court’s determination was whether the new government policy might cause irreparable harm to the states and so whether the application met the procedural and legal requirements.

The states argued that they were entitled to injunctive relief on three main grounds: that the new policy “risks interference with the payment of funds appropriated by Congress [and] exceeds Treasury’s statutory authority and therefore is ultra vires”; that the policy violates the Administrative Procedures Act as it exceeds statutory authority, is illegal and is “arbitrary and capricious”; and that the policy violates the separation of powers doctrine and the Take Care Clause of the Constitution by permitting access to individuals who “may then block payments contrary to Congressional appropriation”. [Complaint, para. 15] The states highlighted the sensitive nature of the BFS, which is responsible for managing and distributing federal payments to millions of citizens, including Social Security benefits, child tax credits, federal employee salaries, and tax refunds, and processes this information through payment files containing sensitive personal data of U.S. citizens, such as Social Security numbers and bank account details, as well as confidential financial information about the amount and nature of the payments made. The states submitted that this processing of highly sensitive financial information, including tax data and electronic payments, is protected by strict regulations, including Section 6103 of the Internal Revenue Code, which governs the confidentiality of tax data, and Title 26 of the Code of Federal Regulations (CFR), Part 301 and electronic payments are subject to Automated Clearing House (ACH) regulations under Title 31 CFR Part 210. They argued that, to ensure the security of this information, only public officials who have received proper cybersecurity training and passed background checks should be granted access.

The states maintained that the new policy aimed to facilitate the selective blocking of federal funds based on political criteria, violating the separation of powers and the Take Care Clause of the U.S. Constitution, and that expanding access to the personal and financial data of millions of individuals posed a significant risk to privacy and security, increasing the vulnerability of these systems to cyberattacks and potential misuse of information for discriminatory or political purposes.

The Court granted a temporary restraining order (TRO) in favor of the states. Applying the standard established in Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008), the Court held that the states would face irreparable harm in the absence of the injunctive relief “because of the risk that the new policy presents of the disclosure of sensitive and confidential information and the heightened risk that the systems in question will be more vulnerable than before to hacking.” [p.2] The Court found that “the balance of the equities, for the reasons stated by the States, favors the entry of emergency relief” and that the legal claims presented by the states were “particularly strong.” [p.2]

Consequently, the Court issued a temporary restraining order prohibiting the President, the Treasury Department, and Treasury Secretary, Scott Bessent, from granting access to BFS payment systems and databases to any individual who is not a career civil servant with the appropriate security clearances and training. Additionally, it ordered that political appointees and special government employees be barred from accessing this data and that any individual who had obtained such information since January 20, 2025, immediately destroy all downloaded copies.

The Court indicated that the case had been assigned to Judge Jeannette A Vargas for final adjudication. It ordered the defendants to appear on February 14, 2025, and explain why a preliminary injunction should not be issued prohibiting political appointees from accessing the Treasury Department’s payment systems and data during the litigation and set deadlines for the parties to submit their arguments and responses.