The Data Transfer A Judge Just Called Illegal

A federal judge has ruled that OPM unlawfully shared millions of employee records with DOGE. Not improperly, not controversially / unlawfully. That word changes what every other DOGE data story has been building toward, and it should change how agencies, lawmakers and the press treat the months of access grants that came before it.

What the ruling actually says

The finding, reported by FedScoop, is narrow on paper and wide in consequence: the Office of Personnel Management broke the law when it handed DOGE millions of employee records. For most of this year, that transfer was discussed as a policy fight, an argument about whether a cost-cutting initiative run out of the executive branch should have access to the personnel data of the federal workforce. A judge has now taken that argument off the table. The access was not a grey area awaiting political resolution. It was unlawful when it happened.

That distinction matters because almost every defence offered for DOGE's data access across government has rested on the premise that the legality was unsettled, that reasonable people could disagree, that this was Congress's fight or the voters' fight rather than a court's. The OPM ruling removes that premise for at least one agency's worth of records. The question is no longer whether DOGE's access was defensible. It is whether the rest of DOGE's access looks like this one.

A pattern, not an incident

Treat the OPM ruling as an isolated event and it is a single court loss for one agency. Treat it as a data point in a pattern and the picture looks worse. FedScoop has also reported that the SBA refocused its Regional Innovation Cluster programme following DOGE cuts, which means DOGE was not simply viewing personnel data, it was actively reshaping programme funding decisions inside agencies it had no statutory mandate over. Separately, Senator Wyden has warned that federal websites are vulnerable to surveillance, a warning that lands differently once a court has confirmed that at least one federal data system was already breached unlawfully by an entity operating with presidential cover but without legal authorisation.

None of this requires speculation about what else might be wrong. It only requires noticing that OPM was not a special case. It was one node in a wider structure of DOGE touching systems, budgets and records across the government, and the one node a court has actually examined came back illegal.

The Musk problem the ruling exposes

The OPM case also sharpens a question that has followed DOGE since its creation: who, exactly, is making these calls, and on whose authority. Ars Technica has reported that it was Musk, not Trump, who ordered the Starlink throttling that blindsided Ukraine, which is a striking data point on its own but becomes more striking read alongside the OPM ruling. In both cases, the pattern is the same: an actor with enormous operational access making unilateral decisions that were not clearly authorised, with consequences that land on people who had no say in the decision, whether that is Ukrainian forces relying on satellite connectivity or federal employees whose personnel records moved without their knowledge or consent.

Broadband Breakfast has also reported on the prospect of a SpaceX-Tesla megamerger that could benefit both companies and Musk's personal fortune. Put the OPM ruling, the Starlink reporting and the megamerger story next to each other and a throughline appears: an individual with access to sensitive federal systems whose other business interests stand to gain from exactly the kind of unchecked executive latitude DOGE was built on. A court has now ruled that at least one instance of that latitude was illegal. It would be strange to assume the rest were different simply because nobody has sued yet.

Why "controversial" was always the wrong word

Calling DOGE's data access controversial let every agency involved treat it as a public relations problem rather than a legal one. Controversial things get managed with statements. Illegal things get managed with lawyers, and eventually with consent decrees, discovery requests and personal liability for the officials who signed off. The OPM ruling moves DOGE's data access into the second category, at least for the records already in front of a judge.

That reclassification has consequences beyond OPM. Every agency that gave DOGE access to records, systems or budget authority now has to ask whether its own transfer looked more like OPM's than it would like to admit. The SBA's programme cuts following DOGE involvement are one place to start asking that question. The vulnerabilities Wyden flagged in federal websites are another. Neither has been the subject of a ruling yet. But the OPM case establishes that when a court actually looks at how DOGE obtained access to a federal system, it is willing to call that access illegal rather than merely irregular.

What comes next

A ruling against one agency does not automatically produce rulings against the rest. Litigation takes time, discovery takes longer, and DOGE's footprint across government was broad enough that untangling every instance of access will not happen quickly. But the legal exposure now runs in one direction. Before this ruling, agencies that gave DOGE access could argue the law had not yet spoken. After it, that argument gets harder to make with a straight face, because the law has spoken, at least once, and it said no.

The people who approved these transfers, inside OPM and potentially inside other agencies, now have to reckon with the fact that a federal judge has put a name to what they did. Not overreach. Not controversy. Illegal. Every other agency that handed DOGE a login, a dataset or a budget line should be treated, until proven otherwise, as the next name on that list.