If one were to believe the voices of outrage on the twitters, Southern District of New York Judge Paul Engelmayor just stopped Treasury Secretary Scott Bressent from being allowed into his own computer system, from overseeing his own department’s payment system. The alternative to losing one’s head is reading the decision, but too few are sufficiently interested in thinking to be bothered. I am not.

The States contend that this policy, inter alia, violates the Administrative Procedure Act (“APA”), 5 U.S.C. §§ 551 et seq., in multiple respects; exceeds the statutory authority of the Department of the Treasury; violates the separation of powers doctrine; and violates the Take Care Clause of the United States Constitution.

Whether or not you care about any of this, and many don’t care because of the syllogism*, the duty of a court is to apply law. You can’t just like that when it works in your favor, but either you accept the premise that we are nation of laws or you don’t. If you’re of the view that Trump’s election renders him omnipotent, then don’t bother reading any further and don’t forget to swallow. But just in case you are of the view that the law still matters even when it doesn’t give you everything you want, then consider Judge Englemayor’s findings.

The Court’s firm assessment is that, for the reasons stated by the States, they will face irreparable harm in the absence of injunctive relief. See Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 20 (2008). That is both because of the risk that the new policy presents of the disclosure of sensitive and confidential information and the heightened risk that the systems in question will be more vulnerable than before to hacking. The Court’s further assessment is that, again for the reasons given by the States, the States have shown a likelihood of success on the merits of their claims, with the States’ statutory claims presenting as particularly strong. The Court’s further assessment is that the balance of the equities, for the reasons stated by the States, favors the entry of emergency relief.

Bruce Schneier, who knows his way around cybersecurity, agrees.

Bruce Schneier, a cybersecurity expert at Harvard and the author of a series of books on security vulnerabilities, including “Click Here to Kill Everybody,” called the entry of Mr. Musk’s force “the most consequential security breach” in American history.

Mr. Schneier noted that the intrusion came “not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role.”

Yet again, you may not care. You may believe that it’s a risk worth taking. You may believe that it has to be done, so shut your eyes and dive into the abyss. But then, the security of the nation, not to mention the faithful application of its laws, doesn’t care what you believe. More importantly, your belief doesn’t change whether this impetuous action is wrong, ranging from improper to catastrophic. Nor, for that matter, is it up to Trump or Musk. Hard as it may be to believe, they are not our new overlords, and while Trump is the putative steward for a term of office, no one quite knows what Musk is. You think you do, but you don’t, no matter how hard you clench your sphincter.

So Judge Englemayor did what any good judge would do. He shut down, pending hearing before the assigned Judge Jeannette A. Vargas, the wild and crazy shenanigans for which the law makes no exception.

ORDERS that, sufficient reason having been shown therefor, pending the hearing of the States’ application for a preliminary injunction, pursuant to Rule 65 of the Federal Rules of Civil Procedure, the defendants are (i) restrained from granting access to any Treasury  Department payment record, payment systems, or any other data systems maintained by the Treasury Department containing personally identifiable information and/or confidential financial information of payees, other than to civil servants with a need for access to perform their job duties within the Bureau of Fiscal Services who have passed all background checks and security clearances and taken all information security training called for in federal statutes and Treasury Department regulations; (ii) restrained from granting access to all political appointees, special government employees, and government employees detailed from an agency outside the Treasury Department, to any Treasury Department payment record, payment systems, or any other data systems maintained by the Treasury Department containing personally identifiable information and/or confidential financial information of payees; and (iii) ordered to direct any person prohibited above from having access to such information, records and systems but who has had access to such information, records, and systems since January 20, 2025, to immediately destroy any and all copies of material downloaded from the Treasury Department’s records and systems, if any;

What is remarkable about Judge Englemayor’s order is its unremarkability. For those inclined to histrionics like “everything is corrupt,” “it’s all fraud” and “burn it all down,” requiring the Treasury Department to adhere to basic law and not give Musk and his lost boys run of the place will seem outrageous. It’s not. It’s just the law.

*The syllogism:

Something must be done.
This is something.
This must be done.