Can Musk Be Stopped?

A high profile lawsuit by Public Citizen takes aim at the DOGE takeover at Treasury.

Image courtesy of NBC Washington

There’s a lot of activity by both Trump and his co-president Elon Musk these days, and it can feel overwhelming. Every time we turn around, there’s some new horror. (Wait, Trump wants the U.S. to take over Gaza?!)

Our natural inclination when bombarded with so much is to curl up, cover our heads and hope it ends soon. Rather than give in to this impulse, however, I want to help chart a path through. To do that, we need to prioritize among the many assaults upon our system and understand clearly what is being done and how we can help.

I don’t want to sugarcoat this. To my mind, the greatest threat right now is this: Elon Musk and his goons have taken over critical payment systems at the Treasury Department. This is a DEFCON 1 moment for our government. An unaccountable private citizen, who is also the world’s richest man acting under authority of a would-be dictator, apparently has admin—not just read-only—access to the very lifeline of our Republic: the money.

With such access, Musk has effective control over trillions of dollars of payments each year, and he could terminate some or even all of these at the flip of a switch. This includes our entire social safety net of Social Security, Medicare, Medicaid and food stamps. This puts tens of millions of American who rely on government support at great risk. Already he is threatening to selectively determine which programs are “wasteful” and cut off the money to them.

Yes, this is illegal. Yes, someone needs to stop it. But how?

Many lawsuits have been filed against DOGE, but I’m watching one closely. It’s by Public Citizen, filed on behalf of three plaintiffs: the Alliance for Retired Americans, the American Federation of Government Employees and the Service Employees International Union. The suit alleges that the personal and private financial information of the plaintiffs’ members was illegally accessed by young Musketeer coders over the weekend.

The Public Citizen lawsuit names as defendants the Treasury, its Secretary, and the Bureau of Fiscal Services, which granted access and even admin rights to Musk’s team. This is smart. The lawsuit goes after these defendants in particular because, if ordered by a court, they are the ones that have the power to revoke the access they granted earlier to DOGE.

When I first heard about the lawsuit, the first question I had was, “What’s the legal hook?” By this I mean, what specific laws were broken, and under what statute or law would a court have the power to step in with an injunction?

That’s what I want to cover today. It’s important that we’re all on the same page about our rights as recipients of federal money and payers of federal taxes, and how Musk and DOGE have violated those rights and must be brought to heel.

The relevant facts

I want to first lay out the facts as alleged in the complaint and as updated with a bit of what we’ve learned since.

On the day of his inauguration, Trump issued an Executive Order that renamed the U.S. Digital Service a “temporary organization” called the U.S. DOGE Service (same acronym of USDS). Agency heads were directed to “take all necessary steps, in coordination with the USDS Administrator and to the maximum extent consistent with law, to ensure USDS has full and prompt access to all unclassified agency records, software systems and IT systems.”

Note the key words “to the maximum extent consistent with law,” a concept I’ll address later. If DOGE is not acting consistent with the law, then they are also outside of what this EO permits. Note also the word “unclassified,” which will matter more in other cases involving classified records at USAID. If DOGE gained access to classified matters, it is also outside the authority of the EO. But that’s a subject for another time.

Though Trump did not formally name Musk as the USDS Administrator, his leadership of DOGE is a matter of numerous public statements by Trump. Not to mention, Musk has been acting like the administrator, so it’s really Musk we’re talking about here, as well as the people he has brought in from the private sector to help him carry out his takeover.

Sometime after Trump was elected, and continuing through his inauguration, DOGE reps approached Treasury Department officials seeking access to the payment system. A lifelong civil servant at the Fiscal Services Bureau named David Lebryk heroically refused that access. After Treasury Secretary Scott Bessent was confirmed by the Senate, he met with Lebryk and put him on administrative leave. Lebryk then announced his retirement after 35 years of service.

On Friday, January 31, 2025, Bessent granted DOGE reps full access to the federal payment system. Musk brought in his people, which included a cadre of young programmers barely out of high school, and they took over the system entirely. They immediately had access to view the personal, private information of tens of millions of recipients as well as the tax return information of tens of millions of federal taxpayers.

But it went beyond merely having access to such confidential and private information. A report by Wired magazine confirmed that the DOGE group acquired not just “read-only” access but actual “admin” privileges to the entire payment system and are busily rewriting code on it. Musk himself indicated on Twitter that “the @DOGE team is rapidly shutting down” certain “illegal payments.”

That’s right: An unelected man is making decisions about which congressionally authorized payments should go through and which intended recipients should and should not receive the money they were promised.

As Talking Points Memo’s Josh Marshall reported yesterday, the DOGE team at Treasury

has already made extensive changes to the code base for the payment system. They have not locked out the existing programmer/engineering staff but have rather leaned on them for assistance, which the staff appear to have painedly provided hoping to prevent as much damage as possible — “damage” in the sense not of preventing the intended changes but avoiding crashes or a system-wide breakdown caused by rapidly pushing new code into production with a limited knowledge of the system and its dependencies across the federal government.

Phrases like “freaking out” are, not surprisingly, used to describe the reaction of the engineers who were responsible for maintaining the code base until a week ago. The changes that have been made all seem to relate to creating new paths to block payments and possibly leave less visibility into what has been blocked. I want to emphasize that the described changes are not being tested in a dev environment (i.e., a not-live environment) but have already been pushed into production.

If you are a software engineer, you know how dangerous the above described circumstances can be, and how they risk crashing the entire system.

Privacy Act violations

Reading the above, it certainly feels like laws were broken. It can’t be the case that someone from the outside like Musk can just waltz in and gain access to all our private financial information and then threaten to withhold payments because, well, he said so.

I’m going to set aside the constitutional question of separation of powers for the moment. There are other cases addressing the big question of which branch of government, the executive or the legislative, gets to decide what to do with our tax money. The long-settled answer is that Congress holds the purse strings, and so it should be the case that Trump can’t just order the flow of money to stop, nor can someone like Musk do so on his behalf.

But here, Musk hasn’t actually done that yet. What he’s done instead is gain access to the information and has threatened to shut off payments. The injury to the public by Musk and DOGE, at least so far, is to our legal rights over our private financial information.

The Public Citizen lawsuit gets to the heart of this by alleging violations of the Privacy Act.

The Privacy Act was passed in 1974 and governs the collection, maintenance, use and dissemination of personal identifiers. We’re familiar with most of these. They are the kinds of things we’re taught never to give out to strangers, such as your name, date of birth and social security number. Generally when people try to get these from you, they’re trying to rob your identity or steal from you.

The Privacy Act, as the Public Citizen complaint notes, protects sensitive personal and financial information from improper disclosure and misuse, including by barring disclosure to individuals who lack a lawful and legitimate need for it.

The specific language of the statute prevents the disclosure of an individual’s record to any person or other agency unless the individual to whom the record pertains consents or some kind of statutory exception applies. Because there was no consent given in this case, the only question is whether some kind of exception kicks in.

The complaint notes two of those exceptions, neither of which apply to non-employees of the Treasury like DOGE who have no official duties:

1. “those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties”; or

2. the “routine use” of the records as described in the agency’s “System of Records Notice” or “SORN.”

The Treasury’s SORN, last updated and published in February 2020, covers at least three kinds of records that are sensitive and private: payment records, debts to the government, and electronic payments to the Federal Government. With respect to these, the SORN specifies that “routine use” refers only to “employees whose official duties require access are allowed to view, administer, and control these records.”

These records can’t be for the “routine use” by DOGE members, who aren’t employees with official duties at Treasury.

SORN are taken very seriously from a transparency standpoint. If an agency wants to make any change to its SORN, it must prepare a notice in the Federal Register “of the existence and character of the system of records.” And at least 30 days before publishing a SORN, an agency must “publish in the Federal Register notice of any new use or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency.”

That of course didn’t happen here either.

Internal Revenue Code violation

The government also keeps sensitive information about our tax returns and personal return information, including taxpayer identity, mailing address, taxpayer ID number, claims for refund, and other financial information on actual tax returns.

Trump, in no small irony, was able to keep the public from seeing his own tax returns for so many years precisely because of these kinds of confidentiality requirements.

The Treasury is subject to the confidentiality requirements of the Internal Revenue Code, which are laid out by statute at 26 U.S.C. § 6103. That section provides that “[r]eturns and return information shall be confidential” and cannot be disclosed by a federal officer and employee unless authorized by statute. As with the Privacy Act, the officers and employees of the Treasury Department may access return and return information if their “official duties require such inspection or disclosure for tax administration purposes.”

Again, not applicable to the DOGE crew.

The power to stop this

It’s one thing for defendants to be found in violation of the Privacy Act and the Internal Revenue Code for having granted Musk and DOGE access to our payments systems and all the personal sensitive financial information within them.

It’s another to take that violation and turn it into something the court can act upon.

Thankfully, Congress thought of this, too. In a general sense, the government is supposed to act by way of established administrative procedures. So it’s not surprising that there’s something called the Administrative Procedure Act (APA) that specifies what can happen when they don’t.

Under the APA, courts are empowered to set aside agency actions that are unlawful, arbitrary, capricious or an abuse of discretion. If the court agrees that the takeover was any of these, it can order the Treasury to shut off access to the federal payment system to Musk and his team. In their complaint, the plaintiffs have alleged facts and laid out a solid legal foundation for why the takeover was all these bad things. From there the court can issue an injunction.

I was hoping by yesterday to hear that the plaintiffs have moved for a preliminary injunction. This is especially true now that Musk has ratcheted up his dangerous rhetoric and a planned migration of the system is set to occur this weekend, raising the risk of system failure given all the new code that was illegally added recently. As a bit of a legal primer, recall that a preliminary injunction will issue if the plaintiffs demonstrate a high probability of success on the merits, there is a risk of irreparable harm should an injunction not issue, the “balance of equities” comparing the harm to the plaintiffs versus the harm to the defendants, and if the injunction serves the public interest.

The law is on the plaintiffs’ side, and the whole nation is at risk because of the defendants’ actions. And when you think about it, for defendants, what real harm is there in preventing DOGE from having access while the case proceeds? That Musk won’t be able to cancel some more funding illegally? An injunction would maintain the status quo ante, which reduces the harm all around and serves the public interest.

While the parties battle it out in court, the public response is growing. Opponents of Musk and DOGE held a large rally outside the Treasury Department yesterday evening, where many members of Congress spoke out against this coup by the broligarchs. In government topplings of years past, takeovers involved seizure of government properties including TV stations and military command centers.

In the coups of today, the takeovers instead involve control of computer and payment systems, which would allow the plotters to hold the nation hostage and usurp power from other branches of government. This is precisely what has already happened as the executive has sought to impound congressionally authorized funds.

A federal district judge has yet to weigh in on the specific crisis at the Treasury, but it likely won’t be long before one does. Given the factual record, the applicable law, and the risk of real harm to the country, a preliminary injunction is probable in my view.

UPDATE at 4:11 P.M.: From inside the courtroom where a motion for a Temporary Restraining Order filed today by plaintiffs was under consideration, and after a one hour hearing during which it was clear the government was trying to blur the lines between DOGE and the Treasury, there are some hopeful signs. Per Jordan Fisher, reporter for WUSA9, a TRO may issue this evening against the Treasury. Let’s hope she does:

Judge Kollar-Kotelly says she's contemplating issuing a TRO (temporary restraining order) this evening to "basically keep the status quo for a very short period of time."

Attorneys for the plaintiffs said they remain concerned data may be compromised.

But what if this administration ignores the court’s decision? So far, the White House hasn’t demonstrated any willingness to defy a court order, choosing instead to rescind unconstitutional memos while still hollowly claiming victory. And the Treasury Department, on which in injunction would lie, may not be willing to take things too far to help out Elon Musk, whose overreaching and bluster already threatens to outshine Trump’s.

But we’ll cross that bridge when we get to it, hopefully before Musk has burned it down. If you’d like to help Public Citizen right now in its courageous fight to save our democracy, you can donate using this link.