three reasons first plaintiffs have standing under this course decision in a ts given that there are sensitive personal information including their social security numbers were intentionally and successfully targeted by data thieves for instance in the third circuit there was a data breach case in which there was a breach but there was no evidence that any information was actually xtal traded or gotten by the data thieves of we are so the is that out the drain to transfer the data out so now you have this instead of personal information in the possession of hostile actors who intentionally targeted that information there's a line once  time when o p m announced that they were going to provide services this is a j one fifty one they said these services are tailored to the potential risks of this particular incident so opium itself  that have perpetrated this type of attack would then go out and commit crimes in a way that would make detection easy so they did you know this was a nationwide class of plaintiffs that was breached the fact that the forms were felt nationwide doesn't identity thieves and part of those agreements say that the victims were victims of this data breach implying that that is perhaps where the id the ultimate source of the data so we would submit that plaintiffs  the proceedings what is known about how you have data hacks when they happen they can happen you know months if not years later  the consolidated and then amended complaint i believe was filed less than a year after these breaches were announced so it's entirely plausible to say that the harms that are reciting in that complaint happening in the months  later yeah those will be just as good later and i think one indication is that you know congress and the consolidated appropriations act of two thousand and sixteen said that these victims are entitled to ten years worth of identity theft protection services so that's one indication of well that's at least you know congress thought ten years at a minimum was a reasonable time there are bills being proposed now to extend life time and what is particularly interesting is congress defined a class of people in title to those benefits as those that had their social security number stolen that's in section six thirty two of the two thousand and sixteen consolidated appropriations act so that that social security number is the key point in this case because  not something like a credit card that if a credit card is stolen you can you know call your credit card company and cancel it and the threat is for the most part over that's what happened in a circuit case where there was no standing there is credit card information  was breached but there was no personally identifiable information like social security numbers that were stolen so that's the that's what we believe it's he hearing that's the line that as i said has been drawn if you look at the decisions in the court of appeals that can rationalize them if intentional and successful targeting of social security numbers in every instance has resulted in standing in any of your clients have their prints taken out i believe that definitely members of the class half i don't know if we've specifically alleged that the plaintiffs in this case have birth certificates but i don't know to me that it's at a minimum social security numbers  keep point that's all we need of course against the government under the privacy act we need actual damages but once you find that we're to substantially risk of harm we submit that the actual damages follow because a as i mentioned the mitigation expenses are reasonable the initial ones at a minimum if we had a substantial risk of harm and be here for a substantial risk of identity theft it's at least plausible at this stage that it completed identity assuming that causation yes is a step right in so i guess the point i'm trying to make is that if you accept that there's a substantial risk it makes sense that it's at least plausible that when that risk comes to fruition and people actually have their identities stolen that it would be attributable to this hack at bet and again we're at the motion to dismiss at the pleading stage and but it's  s so the question is what if that were plainly established yeah well that could be an issue in summary judgment you're right but we submit that at the pleading stage when we have you know made to put instances of actual identity theft that it is possible to attribute that to this hack especially again when the government is offering services saying they're tailored to this particular incident and when they're interesting to plea agreements with criminals who have not by writing the statute setting up a judicial system right so all i'm saying is that given those things it's plausible that we're at a substantial risk and i think it proves that beyond a reasonable doubt or anything about that the government have other purposes but it it contributes to the possibility of our allegations one other point on the privacy act a district court thought that only under reimbursed identity theft as events could constitute actual harm we submit that's your identity stolen you're either going to spend you're going to lose money from that fraud incident or you're going to spend a substantial amount of time and or money to have result of that situation is that even case held the six circuit last time is a contract or immunity protects contractors only for ministerial lee following the directives of the government it does not protect contractors for their own independent wrongdoing which is what we call ledge he points  because the court held there was no an equal chance the court held that there was no negligence in that case but it pretty clearly the reasoning decision was well if the government had just ordered this off the shelf and not specified that the door open outward that there would have been no immunity in that case and really what what the government is asking for it what he can is asking for here is what the campbell you got rejected which is basically anything under the umbrella that we do have a government generally i think it's seems to me that here you have a problem in getting around the exact scheme set up the statute providing and then of the thousand dollars for each instance  act which justice scalia relied on in that case and said you know a discretionary decision by the government so for instance the discretionary decision to design the helicopter so that the door opened outward you could not have sued the government for that if they had kept the manufacturing in house rather than contracted out and therefore we're not going to hold the contractor liable for that because you're really attacking the government's decision and you could not have attacked the government's decision so you can it get get at it through the contractor but here we are alleging that he coined was negligent and did and did wrong independent of what the government instructed it to do that it had thirty data security measures that independently were a just ordered it off the shelf would have created much more liability for the contractor then would have been available against the united states so it was a similar sort of and i think that's what the court in campbell he was getting at is just because you're a government contractor and again this is a and i see my time into extra time but this is a judge made immunity doctrine that they're saying we're trying to displace common there right statutory rights that everyone  acknowledges that but for this immunity doctrine you could have brought these claims ski point so we're saying we're going to displace all of those because of the government interest in contracting and it's the rationale  that explains why we're going to do this in this narrow instance when it's what the government has directed us to ok thank you  it's not enough as opposing counsel said to say that actual damages from the automatically from the risk as the supreme court explained in cooper to have actual damages a plaintiff must of pledge specially pleaded monitoring was available for free in june of two thousand and fifteen for individuals who were affected by the personnel records incidentally recalled there are two incidents at issue here and this claim is not allege which incident she believes she was involved  no i disagree your honor because even if she can even be because it would not be an out of pocket loss she cannot manufacture actual damages under the privacy act by electing to pay for something that she received for free regardless whether it is be a stronger argument that there is indeed a lot of spend with him we don't have an answer no don't have it right we don't have the answer in the supreme court explained in cooper that special damages which are the only damages for which a sovereign immunity waiver is available under the privacy act have to be specially pleaded and proved it's not enough even for defendants just channelers your opinion for the court and grounding explained it's not enough for plaintiffs to merely plead information that would give defendants notice as to the take of damages they were relying on it's not enough to say a fact or i was affected only by the background in the background investigation records incidents because it is only for that incident that credit monitoring first became available in september of two thousand and fifteen individuals affected by the personnel records incident which was a separate incident had free credit monitoring available to them in june of two thousand and fifteen one month before she says she purchased it for herself and so whether or not the court thinks that her fear of  theft is reasonable under the circumstances it is incumbent on her to show that her election will damages constitute losses that are of course proximately caused not just traceable but proximately caused by the incidence in which she complained because it was like a fact dispute to me i mean she's she's made this allegation i made these expenses in direct response to this concrete expenses in direct response to this breach and then your argument is well we don't think you needed to know where why is that well why is that appropriate in this stage as opposed to this and i think i didn't hear her because the question of the pleading stage is not whether she thinks she needs them the question at the pleading stage is whether or not her identity theft and i went and got my own protection not trusting the government so much right now so even on that articulation judge millette her allegations fail at the first stage because she doesn't identify which breach was affected it which it doesn't take discovery or any other factual development to show she would know based on the notice that she got from a pm and our point is only that for her in the many visit point is even if she was in the one we're already providing service an allegation to get past the moment this early stage companies say because the supreme court in cooper was not focused on whether or not anybody trusted the governmental whether or not their reaction was reasonable the court explained that what is necessary for actual damages for a sovereign immunity waiver and of course in some immunity the question is whether congress has unequivocally authorized play to seek a particular kind of damages the question is whether a plaintiff has alleged out of pocket l and our basic point is that you are not at a loss if you elect to pay for something that the government has given you for free and if your arguments to williams as you posited is that you wanted something that was not available for you to do for free  still your duty under cooper to specially plead why it is that your injury was not self inflicted and of course it's worth noting we are talking about one plaintiff out of thirty eight individual plaintiffs and so whatever the court with respect to this plan and it's worth underscoring she has to show not only actual damages but actual damages that were approximately caused by the incident we are nowhere near a sovereign immunity for waiver for any of the remaining on particularly in light just williams as you observed the allegations of fraud and the general susceptibility of individuals to freud which is highlighted by kelly flynns own assertions she s for example that her has and whose information she doesn't allege o p m had was also the victim of fraud she alleges fraud involving her without providing any special sense if a city about when the fraud occurred which under this court's decision arpaio clearly is not enough a plaintiff cannot just say that two things happen in sequence and require the court to accept the inference that they are connected and so here for multiple reasons whether you interpret her claims under the rubric of sovereign immunity or as a matter of standing we simply are not near what she the person and the plaintiffs a put forth as their strongest individual class who to class representative would need to say at the pleading stage disputed here i don't think it can be disputed that o p m over time has done a great deal to improve its cyber security measures that it continues to engage in the terrorist didn't work so well in this case i mean this is a huge here even if what the plaintiffs have alleged or rises to negligence that it's not sufficient to meet the privacy act demanding standards when a court is inquiring whether an agency failed to establish appropriate cards that allow the agency to consider the technological feasibility of their implementation because the benefits in light of the risk to which the agency is aware and in the face of recommendations that were explicitly discretionary they are styled his recommendations  do not show he willful or intentional violation because what they have planted is a failure to respond more expeditiously to discretionary recommendations in the face of what they even say  performed negligently that's that's correct your honor and that would not is a motion to dismiss that's right but under this under the case of the supreme court dating back now but that i'm not sure where you're to write your sovereign immunity from they are not actually claiming immunity you're not sharing they can believe all talk about sharing all our city was all about sharing and even boil it was at least willful as defined failure to seek here the information and they had the damages that are required why so the government's not in that case right on what basis would there be contractor immunity right which is assume we find peculiar and damages assume we find that the district court is correct knowing it wolf that that's the hypothetical both of us are asking then what's the basis for in that case that the government would be the only us about giving contractors most sane unity that's why they're going to be left holding the bag in the same immunity that the government is going to have the government had it there are government agents certainly would get qualified or are paid to have a credit freeze listed which is undisputed that o p s coverage did not provide a credit freeze so that's an additional plaintiff there are others as well with respect to the willful intentional issue not saying just that o p m didn't act quickly enough to address not discretionary heard just arrest this question area issues were saying that there were federal requirements that they did not implement year after year and willfully and intentionally did not do that as paragraph one fifty two of the complaint explains in two thousand and fifteen their own inspector general said our repeated warnings appeared to garner little attention at the agency and you know effectively we told you so so we're not just saying that ourselves  for a period of a much broader problems yes and that's going to be counted so that no actual damages the current right exactly we're suing under these common law claims which it would be extraordinary under this judge made doctrine to say that all of these private rights of action that they indisputably would have if you know if they have been contracting with a defendant in a ts for example we could bring all these claims against them they're saying just because they contradicted with the at a minimum cannot disclose that information to those without the authority to view it there is an affirmative abrogation the course imputed and the government based upon the red alert only not to disclose that information to those who can see it all three cases each case where it said well there mediate a kind of constitutional right you're seeking a court said we don't have to reach that question because number one the government has a very strong interest in collecting  keeping it and number two the government through various steps has shown to the high degree of sensitivity towards protecting the day that that's when all three of those cases did so if you think about that framework and of information but the are you complain that it isn't is the alleged constitutional violation here a storage violation or are you challenging storage when you say made it possible for this to happen they didn't store it securely or are you offering a theory in which the government was  don't think it's just a bare assertion that it's enough for injury so it but not here because what they're asking for is judicial superintendents of o p m data security lifetime credit monitoring and an order prohibiting o p m from storing their information electronically they would have to show that that relief none speculative only redress it  of future identity theft and so that's why although we think and i'm happy to explain that even without getting to the injunction the injunctive relief that they've asked for that their claims are too speculative to support standing here there's because you're under what they would be saying is that the courts i'm going superintendence of o p s data security systems goes in some way to redress their fear of future identity theft based on the incidents that have already occurred that's why even if you think that the plaintiffs in the first case have standing because of the different form of relief that the plaintiffs in this case are seeking there's an additional level of speculation required and just not usually a speculative we say things are speculative because we think risk dissipates but congress thought at least ten years was a window here so why wouldn't why don't what makes you think that the risk that your social security number and name and date of birth will be used to commit identity theft goes down at all as long as you're alive of course your honor it's not what i think it's what is incumbent on the plaintiffs to allege in here does it become any more likely that your social security more or less likely that your social security name social security number name and address can be used for identity theft in five years rather than this year speculation from the court that not only at the moment of the data breach but even after the passage of time notwithstanding to williams as you observed the general incidence of identity theft in the us population that there will be an be disputed and in litigation as to who is responsible for the when you're there i think it really would be helpful for me to take a step back and explain why even setting aside the nature of relief that they've set up which i do think requires  speculation but forgetting that for the moment why there isn't standing here it's not enough simply to say that his social security number has been exposed to think his have to connect that to a cousin eyes of the risk of identity theft the court to go online to to evaluate whether it was possible to infer under the circumstances of that case that there was a kind of nice little risk of identity theft that might follow and this i think is it i'm only speaking for one member of the pa that the relief they're seeking would redress their injury and they have never explained how an order for example wiring a court to assume management over o p s data security systems would redress the sense of security that they say they lost irretrievably at the moment that the breach occurred and so that's why even as to just their constitutional claim their standing argument fails as a matter of redress ability now they have a separate problem based on the rel that they're seeking when it comes to their standing argument as to the risk of future identity theft a t is as i was discussing with judge hill i submit does not say that as it is sufficient any time a social security number is exposed for every affected plaintiff to have standing no matter what happens afterwards and that is really the theory that this court would have to embrace in order to rule out either for the plaintiffs in the first case were for the plaintiffs in this case the plaintiffs in this with the case where that's actually happened and of course a paper and and a second difference is that you know we we have allegations here of reckless behavior by the government not just negligent what why isn't that enough to distinguish him and for whom for a court to rule that what we have here is a violation of  and that as a direct lesson difference point i think this only underscores the extent to which their constitutional claim is an attempt to and around the privacy act which requires willful and intentional conduct and the only cases to which they point involving will of police forces williams case we're not dealing here even with the sort of decision that is ordinarily understood to implicate substantive due process were to rise to a country and checking levels i mean we're dealing here with programatic decisions not includes reckless disregard to you your honor we have a brief to that question and i think the plaintiffs regard it as different and so we are assuming and taking it sort of on their terms they say that the privacy act requires intentional and willful behavior but that their claims are about reckless indifference and so our point is simply that no court has recognized a right within several steps removed the right that asserting here as they have been quite candid about getting out and here we have the privacy act and we have a circumstance well although it's true that there was an intrusion the supreme court has recognized that that alone does not vitiate the role of the crime scene act in protecting any rights that m