UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

AMERICA FIRST LEGAL FOUNDATION, : : Plaintiff, : Civil Action No.: 24-1092 (RC) : v. : Re Document No.: 22 : ROBERT F. KENNEDY, JR., et al., : : Defendants. :

MEMORANDUM OPINION

GRANTING DEFENDANTS’ MOTION TO DISMISS; DENYING AS MOOT DEFENDANTS’ MOTION FOR PARTIAL RECONSIDERATION

I. INTRODUCTION

Federal law and regulations require agencies to retain certain records, including most

emails, for specific periods of time. After learning that the Centers for Disease Control (“CDC”)

was deleting former employees’ emails, America First Legal Foundation (“America First”)

initiated this lawsuit against Secretary of Health and Human Services Robert F. Kennedy, Jr.; the

Department of Health and Human Services, where CDC is housed; Marco Rubio, Acting

Archivist of the United States; and the National Archives and Records Administration

(“NARA”) (collectively, “Defendants”). 1 The Court agreed with America First that CDC’s

recordkeeping policy likely violated federal law, and granted its motion for a preliminary

injunction. Since then, CDC has adopted a new records retention policy that it argues moots

1 The complaint named Biden administration officials as defendants, but pursuant to Federal Rule of Civil Procedure 25(d) they have been automatically substituted by their successors. America First’s claims. The Court agrees. For the reasons discussed below, the Court will grant

Defendants’ motion to dismiss and deny as moot their motion for partial reconsideration.

II. BACKGROUND

The Court presumes familiarity with the factual and legal background, which was

described in detail in the Court’s prior memorandum opinion. See Mem. Op. Granting Pl.’s Mot.

Prelim. Inj. (“America First I”), ECF No. 20. An overview follows.

America First is a nonprofit that, among other things, investigates federal agencies

through records requests pursuant to the Freedom of Information Act (“FOIA”),

.

Compl. ¶¶ 7–11. In responding to one of America First’s FOIA requests in 2023, the CDC

acknowledged that it deleted most former employees’ emails 30 (or 90) days after the

employee’s departure from the agency. 2

; Defs.’ Opp’n Pl.’s Mot. Prelim. Inj. at 6–8,

ECF No. 13. Some of the emails that America First sought were destroyed pursuant to that

policy. Compl. ¶ 26.

America First concluded that CDC was “willfully disregarding” its “duties and

obligations” under the Federal Records Act (“FRA”), 44 U.S.C. §§ 2201–09, 2901–11, 3101–07,

3301–14, which governs “the creation, management, and disposal of federal records.” See

Compl. ¶ 28; Armstrong v. Bush (“Armstrong I”),

(D.C. Cir. 1991). The FRA

requires agencies to “preserve records” of “the organization, functions, policies, decisions,

procedures, and essential transactions of the agency.”

. It also “establishes the

exclusive means by which records subject to the FRA may be discarded.” Pub. Citizen v. Carlin,

(D.C. Cir. 1999); see also

. Before “disposing of any

2 Whether the retention period was 30 or 90 days is immaterial. See America First I at 3 n.1.

2 record,” agencies must have the approval of the Archivist, the head of the National Archives and

Records Administration (“NARA”). Pub. Citizen,

; see also Armstrong v. Exec.

Off. of the President, Off. of Admin.,

(D.C. Cir. 1993); Competitive Enter. Inst.

v. Off. of Sci. & Tech. Pol’y,

(D.D.C. 2017).

When the head of a federal agency “knows or has reason to believe” that records “have

been unlawfully removed” from agency custody, she has a duty to “initiate action through the

Attorney General for the recovery of [the] records.”

(a). If the agency head

does not do so “within a reasonable period of time,” that responsibility transfers to the Archivist.

§ 3106(b); see id. § 2905(a).

Agencies are also required by the FRA to establish records management programs that

comply with the statute and its implementing regulations. See id. § 3102. To that end, the

Archivist promulgates general records schedules “authorizing the disposal, after the lapse of

specified periods of time, of records of a specified form or character.” Id. § 3303a(d). General

Records Schedule 6.1 (“GRS 6.1”) applies to email and other electronic messages for agencies,

like CDC, that have adopted the “Capstone approach” to records management. See Compl., Ex.

E (“General Records Schedule 6.1”) at 1, ECF No. 1-5. GRS 6.1 is content-agnostic: the period

of time that an email must be retained depends only on whether the sender is a Capstone official

or non-Capstone official. America First I at 5 n.2. “Capstone Officials are senior officials

designated by account or position level”; non-Capstone officials are “all other officials, staff, and

contractors.” Id. at 4. GRS 6.1 provides that Capstone officials’ emails are permanently

retained. GRS 6.1 at 3. For non-Capstone officials, GRS 6.1 sets a retention period of 3 years

for administrative staff and 7 years for others. Id. at 5. The “majority” of agency employees’

emails must be retained for 7 years. Id.

3 In 2016, CDC had sent NARA a form certifying that it would use GRS 6.1 to manage

email records for “all” of its employees. Verification for Implementing GRS 6.1: Email

Managed Under a Capstone Approach (“Verification Form”) at 1, available at

https://perma.cc/CA3N-MC4U. And the Department of Health and Human Services (“HHS”), of

which CDC is a component, states in its records management policy that “HHS has adopted the

Capstone approach (GRS 6.1).” See HHS Policy for Records Management, § 6.2.3 (Feb. 2024),

available at https://perma.cc/D3KFNU28. A letter sent by NARA to CDC on April 7, 2023,

confirmed that HHS had adopted the Capstone approach in 2016 “to manage agency

emails/email accounts.” See Compl., Ex. C (“Apr. 2023 Letter”), ECF No. 1-3.

In March 2023, America First wrote to the Department of Health and Human Services

(“HHS”) Inspector General and to NARA describing CDC’s alleged noncompliance with the

FRA and its implementing regulations. Compl. ¶¶ 28, 29. NARA began an investigation. Id.

¶ 30. It requested that CDC explain “whether email records of separated employees have been

prematurely deleted, and are not being preserved and managed in accordance with GRS 6.1.”

Apr. 2023 Letter. In response, CDC clarified that it had adopted GRS 6.1 only for Capstone

officials, and that all other agency employees were expected to “use traditional records

management practices, meaning that they must file and preserve their records based on the

subject matter.” See Decl. of Laurence Brewer ¶¶ 14–15, ECF No. 13-2; see also Compl. ¶ 40.

On February 23, 2024, NARA acknowledged that CDC’s policy was to have employees

“maintain records outside of email accounts in a proper record-keeping system, shared drive,

personal drive, or physical format.” Compl., Ex. D (“Feb. 2024 Letter”) at 1, ECF No. 1-4. That

was enough to satisfy NARA, so it closed the investigation. Id.

4 But it was not enough for America First, which filed this lawsuit in April 2024, see

generally Compl., alleging that CDC’s policy and practice of deleting non-Capstone employees’

emails months after their departures violated GRS 6.1 and thus derivatively violated the FRA

and the Administrative Procedure Act (“APA”),

et seq. Count I of the complaint

alleges that Kennedy and Rubio have violated

by failing to ask the Attorney

General to initiate legal action to recover the deleted emails. Compl. ¶¶ 68–76. Count II states

that HHS and CDC’s recordkeeping policies for former employees’ emails are “inadequate,

arbitrary, capricious, and otherwise not in accordance with the Federal Records Act.”

¶¶ 77–

83. For relief, America First seeks a declaration that Defendants have violated the APA and the

FRA; and a permanent injunction requiring Defendants to (1) initiate an enforcement action

through the Attorney General and (2) “maintain an adequate recordkeeping system under the

Federal Records Act.”

at 21–22. It also requests costs and attorneys’ fees, plus any other

relief the Court “deems just, proper, or equitable.”

.

Shortly after filing the complaint, America First moved for a preliminary injunction,

which Defendants opposed. Mot. Prelim. Inj., ECF No. 6; Pl.’s Mem. Supp. Appl. Prelim. Inj.,

ECF No. 6-1; Defs.’ Opp’n Pl.’s Mot. Prelim. Inj.; Pl.’s Reply Supp. Appl. Prelim. Inj., ECF No.

14. After oral argument, both parties submitted supplemental briefing. Tr. Mot. Hr’g, ECF No.

15; Defs.’ Suppl. Br. Defs.’ Opp’n Pl.’s Mot. Prelim. Inj., ECF No. 16; Pl.’s Resp. Defs.’ Suppl.

Br. Opp’n Pl.’s Appl. Prelim. Inj., ECF No. 18.

The Court granted the preliminary injunction. Order Granting Pl.’s Mot. Prelim. Inj.,

ECF No. 19. Starting with Count I, the Court reasoned that Plaintiffs had alleged facts

establishing that the Archivist—although not necessarily the Secretary of HHS—was likely

obligated by the FRA to refer the matter to the Attorney General. America First I at 8–22. For

5 Count II, the Court held that Plaintiffs had stated a justiciable claim under the APA,

at 23–26,

and that they were likely to show that the CDC’s policy was unlawful or inadequate,

at 26–

28. The Court concluded that CDC’s continued deletion of employee emails, which would

permanently deprive America First and the wider public of access to federal records, constituted

irreparable harm.

at 28–33. Finally, the Court determined that the balance of equities and the

public interest supported issuing a preliminary injunction.

at 33–35. The Court enjoined

CDC from deleting or destroying non-Capstone employees’ emails until the time periods

established by GRS 6.1 passed, or until the Court were to issue an updated order following the

Archivist’s approval of an alternate disposal schedule.

. The Court further ordered that

the Archivist seek the assistance of the Attorney General to recover, “to the extent reasonably

possible,” the prematurely deleted email records, and “ensure the proper preservation of emails

when lower-level CDC employees leave the agency.”

The same day that the Court issued the preliminary injunction, CDC temporarily applied

GRS 6.1 to all its employees and placed a litigation hold on email accounts belonging to

employees who had left the agency within the prior 90 days. Defs.’ Mot. Dismiss and Mot.

Partial Recons. at 1 (“Defs.’ Mot.”) at 6, ECF No. 22. CDC was able to recover the email

accounts of former employees going back to April 2, 2024, because CDC’s email services

provider, Microsoft, had not yet deleted those accounts.

.

Working with Microsoft and NARA, CDC then implemented an “inactive mailbox”

policy, which allows the agency to keep former employees’ email accounts on hold.

When

an inbox is inactive, it cannot be used to send or receive emails, but its content is retained.

“Authorized CDC employees, including FOIA officers, can access” inactive mailboxes.

Under the new policy, the records contained in former employees’ email accounts are

6 automatically retained for at least seven years.

In August 2024, CDC, with NARA’s

approval, formally adopted GRS 6.1 for all employees.

.

CDC and Microsoft also took steps to determine whether they could recover former

employee email accounts that had already been deleted. Id.; see also Decl. of Jason Bonander

(“Bonander Decl.”) ¶¶ 16–22, ECF No. 22-1. Within Microsoft’s system, there are two kinds of

deletion: “soft deletion” and “hard deletion.” Defs.’ Mot. at 8 (internal quotation marks

omitted); see also Microsoft, Microsoft 365 Exchange Data Deletion, available at

https://perma.cc/A9GR-XBNB (April 24, 2024). After a user’s Microsoft license is removed,

“Microsoft automatically ‘soft deletes’ all content associated with that license, including emails.”

Defs.’ Mot. at 8. “When an email account is soft deleted, Microsoft retains the data for 30 days,

during which” time it is recoverable.

After that, Microsoft hard deletes the data.

.

Hard deletion is permanent.

Six or seven days after hard deletion, the data is forensically

wiped.

According to the CDC, “[o]n September 6, 2024, Microsoft informed CDC and NARA

that it could not recover any of CDC’s hard deleted data.”

There is an at most six- to seven-

day period after data is deleted that “Microsoft could engage in forensic attempts to recover

[that] data.”

But those attempts “would require unreliable and extraordinary efforts” and

may not be successful.

(internal quotation marks omitted). “[I]t is not possible . . . to recover

data that has been forensically wiped.”

Based on these factual developments, Defendants have moved to dismiss the complaint

as moot under Federal Rule of Civil Procedure 12(b)(1). Defs.’ Mot. at 11–14. In the

alternative, they request that the Court reconsider the part of its preliminary injunction order

requiring them to ask the assistance of the Attorney General to recover and preserve former CDC

7 employees’ emails.

at 17–22. Plaintiff filed an opposition, and Defendants replied. Pls.’

Opp’n Defs.’ Mot. Dismiss and Mot. Partial Recons. (“Pl.’s Opp’n”), ECF No. 24; Defs.’ Reply

Supp. Defs.’ Mot. Dismiss and Mot. Partial Recons. (“Defs.’ Reply”), ECF No. 25. Defendants’

motion is now ripe for review.

III. LEGAL STANDARD

In evaluating a motion to dismiss, the Court must “treat the complaint’s factual

allegations as true . . . and must grant [P]laintiff ‘the benefit of all inferences that can be derived

from the facts alleged.’” Sparrow v. United Air Lines, Inc.,

(D.C. Cir.

2000) (quoting Schuler v. United States,

(D.C. Cir. 1979)) (citation omitted);

see also Jerome Stevens Pharm., Inc. v. FDA,

(D.C. Cir. 2005). The

pleading rules are “not meant to impose a great burden upon a plaintiff,” Dura Pharm., Inc. v.

Broudo,

(2005); so, the Court makes all factual inferences in the plaintiff’s

favor. Sparrow,

.

Under Federal Rule of Civil Procedure 12(b)(1), a plaintiff bears the burden of proving

that the Court has subject-matter jurisdiction to hear its claims. See Lujan v. Defs. of Wildlife,

(1992). A court also has an “affirmative obligation to ensure that it is acting

within the scope of its jurisdictional authority.” Grand Lodge of Fraternal Ord. of Police v.

Ashcroft,

(D.D.C. 2001). For this reason, “‘the [p]laintiff’s factual

allegations in the complaint . . . will bear closer scrutiny in resolving a 12(b)(1) motion’ than in

resolving a 12(b)(6) motion for failure to state a claim.”

at 13–14 (quoting 5A Charles A.

Wright & Arthur R. Miller, Federal Practice and Procedure § 1350 (2d ed. 1987) (alteration in

original)). In evaluating a motion to dismiss under Rule 12(b)(1), the Court “may consider

materials outside the pleadings in deciding whether to grant a motion to dismiss for lack of

8 jurisdiction.” Jerome Stevens,

; see also Venetian Casino Resort, LLC v.

EEOC,

(D.C. Cir. 2005).

A claim is moot if “the issues presented are no longer live or the parties lack a legally

cognizable interest in the outcome.” Larsen v. U.S. Navy,

(D.C. Cir. 2008)

(citation omitted). Federal courts lack jurisdiction to decide moot claims “because their

constitutional authority extends only to actual cases or controversies.” Conservation Force, Inc.

v. Jewell,

(D.C. Cir. 2013) (citation omitted).

For the Court to have subject-matter jurisdiction, the plaintiff must also have Article III

standing. Lujan, 504 U.S. at 560–61. Standing is an “irreducible constitutional minimum” that

requires a plaintiff to establish, among other things, that he suffered an “injury in fact”: a harm

that is “concrete” and “actual or imminent, not ‘conjectural’ or ‘hypothetical.’” Id. at 560;

Whitmore v. Arkansas,

(1990) (quoting Los Angeles v. Lyons,

,

101–02 (1983)). “At the pleading stage, general factual allegations of injury resulting from the

defendant’s conduct may suffice.” Lujan,

. If a plaintiff lacks standing, the

complaint must be dismissed for lack of subject-matter jurisdiction. See Fed. R. Civ. P. 12(b)(1).

IV. ANALYSIS

The Court agrees with Defendants that intervening factual developments have stripped it

of subject-matter jurisdiction over America First’s claims. The Court therefore does not reach

Defendants’ alternative arguments that it should reconsider Part II of the preliminary injunction

order.

A. Count One

In Count I, America First demands that the head of HHS and the Archivist request the

assistance of the Attorney General to recover the deleted records pursuant to 44 U.S.C.

9 § 3106(a), (b). Compl. ¶¶ 68–76. The request is moot if it would be “pointless.” Judicial

Watch, Inc. v. Pompeo (“Judicial Watch III”), 744 Fed. App’x 3, 4 (D.C. Cir. 2018) (per curiam).

Defendants are not required to “somehow squeeze water out of the rock.” In re Clinton,

(D.C. Cir. 2020). The request is not moot, however, if there is a “substantial

likelihood” that the Attorney General could find some deleted records. Cause of Action Inst. v.

Pompeo,

(D.D.C. 2018).

According to Jason Bonander, the Acting Chief Information Officer for CDC, the agency

and its email service provider have obtained copies of as many of the deleted records as possible.

Bonander Decl. ¶¶ 18, 20–22. “[N]o known methodology” can recover the data in email

accounts that were “hard deleted” or “forensically wiped” before the litigation hold took effect.

¶¶ 21–22. Any further search for the deleted records would be “a wild goose chase and a

waste of time.” See Cause of Action Inst.,

. That means Count I is moot.

See

(dismissing as moot similar claim where defendants had shown that “recovery of

the [requested] emails is technologically impossible”).

America First argues that it still has a concrete interest in Count I because the Attorney

General could pursue recovery of removed records from individual former employees. Pl.’s

Opp’n at 5–6. It acknowledges that the Attorney General may ultimately take no action, “but

that discretion belongs to the Attorney General, not to the Defendants.” Id. at 7.

The problem with that position is that the Complaint alleges that the deleted emails were

removed systemically by CDC, not by individual former employees. See generally Compl. And

the Court presumes that former government employees did not take records home with them in

violation of agency policy. Competitive Enter. Inst.,

(“[G]overnment

10 employees . . . are entitled to the presumption that they complied with agency policies, absent

evidence to the contrary.”) (citing Bracy v. Gramley,

(1997)).

America First does not dispute that CDC and NARA have taken every reasonable action

to recover all the recoverable emails. See Defs.’ Mot. at 15; Pl.’s Opp’n at 5. What’s left for

Count I, then, is a purely procedural claim under

(a): referral to the Attorney

General. “[B]are procedural violation[s], divorced from any concrete harm” do not establish

Article III standing. TransUnion LLC v. Ramirez,

(2021) (quoting Spokeo,

Inc. v. Robins,

(2016)) (first alteration added, second alteration in original);

see also Summers v. Earth Island Inst.,

(2009) (“[I]t would exceed [Article

III’s] limitations if, at the behest of Congress and in the absence of any showing of concrete

injury, we were to entertain citizen suits to vindicate the public’s nonconcrete interest in the

proper administration of the laws. . . . [T]he party bringing suit must show that the action injures

him in a concrete and personal way.”) (internal quotation marks omitted) (alteration in original).

The Court concludes that it lacks jurisdiction over Count I because (1) Defendants have taken

actions that extinguished the underlying claim; and (2) the CDC and Archivist’s lack of referral

to the Attorney General does not, in and of itself, constitute a cognizable Article III injury. See

Judicial Watch, Inc. v. Kerry (“Judicial Watch I”),

(D.C. Cir. 2016) (holding

that if the Secretary and Archivist “show[]” that a request to the Attorney General “could not

lead to the recovery of additional emails,” the claim for referral is moot).

B. Count Two

In Count II, America First alleges that HHS and CDC’s recordkeeping policies violate the

FRA and the APA. See Compl. ¶¶ 77–83. Since the Court issued the preliminary injunction,

CDC, with NARA’s approval, adopted GRS 6.1 for all its employees. Mot. Dismiss at 12; see

11 also Bonander Decl. ¶ 15; Decl. of Margaret Hawkins (“Hawkins Decl.”) ¶ 6, ECF No. 22-2.

Now all former employees’ email accounts are saved for the seven-year retention period

provided for under GRS 6.1. Bonander Decl. ¶¶ 12–15; Hawkins Decl. ¶¶ 5–6. Defendants

argue that this renders Count II moot. Mot. Dismiss at 12–14. The Court agrees.

“The promulgation of a superseding policy” can “moot a challenge to the old one.”

Citizens for Resp. & Ethics in Wash. v. Pompeo,

, at *8 (D.D.C. Sept. 25,

2020) (citation omitted). Here “the revised policy corrects the fundamental defect in the old

one” by preserving all former employees’ emails for at least seven years, as required by GRS

6.1. See Citizens for Resp. & Ethics in Wash. v. Wheeler,

(D.D.C. 2019).

Nonetheless, America First contends that CDC’s violation of the FRA may recur because absent

a court order the agency could “repeat[] its past unlawful activity.” Pl.’s Opp’n at 9.

The D.C. Circuit has made it clear that courts can review only two classes of claims

under the FRA: challenges to “the adequacy of an agency’s recordkeeping guidelines” and

claims that an agency head or the Archivist failed to seek initiation of an enforcement action by

the Attorney General when required to by law. Armstrong I, 924 F.2d at 292–95. The Court

cannot consider whether CDC is acting in compliance with its new recordkeeping policy. See

Competitive Enter. Inst. v. EPA,

(D.D.C. 2014) (noting that, under

Armstrong I, “challenges to the agency’s day-to-day implementation of its [record-keeping]

guidelines” are unreviewable). It is merely speculative that CDC may, at some point in the

future, adopt a new recordkeeping policy that violates the FDA. If that comes to pass, America

First can bring a new legal challenge then. For now, though, HHS and CDC “maintain an

adequate recordkeeping system under the Federal Records Act,” see Compl. at 22, so Count II is

moot.

12 V. CONCLUSION

For the foregoing reasons, Defendants’ motion to dismiss is granted; and their motion for

partial reconsideration is denied as moot. Because the Court now lacks subject-matter

jurisdiction over this action, it will also dissolve the preliminary injunction. An order consistent

with this Memorandum Opinion is separately and contemporaneously issued.

Dated: June 20, 2025 RUDOLPH CONTRERAS United States District Judge

13