author: DIAZ, Circuit Judge:

text:
    Richard G. BECK; Lakreshia R. Jeffery; Beverly Watson; Cheryl Gajadhar; Jeffery Willhite, on behalf of themselves and all others similarly situated, Plaintiffs-Appellants, v. Robert A. MCDONALD, in his official capacity as Secretary of Veterans Affairs; Timothy B. McMurry, in his official capacity as the former Medical Director of William Jennings Bryan Dorn VA Medical Center; Bernard L. Dekoning, in his official capacity as the Chief of Staff of William Jennings Bryan Dorn VA Medical Center; Ruth Mustard, RN, Director for Patient Care-Nursing Services of William Jennings Bryan Dorn VA Medical Center; Jon Zivony, Assistant Director of William Jennings Bryan Dorn VA Medical Center; David L. Omura, in his official capacity as the Associate Director of William Jennings Bryan Dorn VA Medical Center, Defendants-Appellees. Beverly Watson, on behalf of herself and all others similarly situated, Plaintiff-Appellant, v. Robert A. McDonald, in his official capacity as Secretary of Veterans Affairs; Timothy McMurry, in his official capacity as the Medical Director of William Jennings Bryan Dorn VA Medical Center; ruth mustard, RN, in her official capacity as the Associate Director for Patient Care/Nursing Services of William Jennings Bryan Dorn VA Medical Center; David L. Omura, in his official capacity as the Associate Director of William Jennings Bryan Dorn VA Medical Center; Jon Zivony, in his official capacity as the Assistant Director of William Jennings Bryan Dorn VA Medical Center; Sue Panfil, in her official capacity as the Privacy Officer of William Jennings Bryan Dorn VA Medical Center, Defendants-Appellees.
    No. 15-1395, No. 15-1715
    United States Court of Appeals, Fourth Circuit.
    Argued: September 20, 2016
    Decided: February 6, 2017

      ARGUED: Douglas J. Rosinski, Columbia, South Carolina, for Appellants. Sonia Katherine McNeil, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C., for Appellees. ON BRIEF: D. Michael Kelly, Bradley D. Hewett, MIKE KELLY LAW GROUP, LLC, Columbia, South Carolina, for Appellants. Benjamin C. Mizer, Principal Deputy Assistant Attorney General, Mark B. Stem, Civil Division, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C.; William N. Nettles, United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Columbia, South Carolina, for Appellees.
    Before NIEMEYER and DIAZ, Circuit Judges, and Irene M. KEELEY, United States District Judge for the Northern District of West Virginia, sitting by designation.
   DIAZ, Circuit Judge:

The Plaintiffs in these consolidated appeals are veterans who received medical treatment and health care at the William Jennings Bryan Dorn Veterans Affairs Medical Center (“Dorn VAMC”) in Columbia, South Carolina. After two data breaches at the Center compromised their personal information, the Plaintiffs brought separate actions against the Secretary of Veterans Affairs and Dorn VAMC officials (“Defendants”), alleging violations of the Privacy Act of 1974, 5 U.S.C. § 552a et seq. and the Administrative Procedure Act (“APA”), 5 U.S.C. § 701 et seq.

In both cases, the Plaintiffs sought to establish Article III standing based on the harm from the increased risk of future identity theft and the cost of measures to protect against it. The district court dismissed the actions for lack of subject-matter jurisdiction, holding that the Plaintiffs failed to establish a non-speculative, imminent injury-in-fact for purposes of Article III standing. We agree with the district court and therefore affirm.

I.

A.

The Beck case arises from a report that on February 11, 2013, a laptop connected to a pulmonary function testing device with a Velcro strip was misplaced or stolen from Dorn VAMC’s Respiratory Therapy department. The laptop contains unencrypted personal information of approximately 7,400 patients, including names, birth dates, the last four digits of social security numbers, and physical descriptors (age, race, gender, height, and weight).

An internal investigation determined that the laptop was likely stolen and that Dorn VAMC failed to follow the policies and procedures for utilizing a non-encrypted laptop to store patient information. Dorn VAMC officials used medical appointment records to notify every patient tested using the missing laptop and offered one year of free credit monitoring. To date, the laptop has not been recovered.

Richard Beck and Lakreshia Jeffery (the “Beck plaintiffs”) filed suit on behalf of a putative class of the approximately 7,400 patients whose information was stored on the missing laptop. Relevant to this appeal, the Beck plaintiffs, sought declaratory relief and monetary damages under the Privacy Act, alleging that the “Defendants’ failures” and “violations” of the Privacy Act “caused Plaintiffs ... embarrassment, inconvenience, unfairness, mental distress, and the threat of current and future substantial harm from identity theft and other misuse of their Personal Information.” J.A. 12. They further allege that the “threat of identity theft” required them to frequently monitor their “credit reports, bank statements, health insurance reports, and other similar information, purchas[e] credit watch services, and [shift] financial accounts.” J.A. 12.

In addition to their Privacy Act claims, the Beck plaintiffs sought broad injunctive relief under the APA, requiring the VA to account for all Privacy Act records in the possession of Dorn VAMC and to recover and permanently destroy any improperly maintained records. The Beck plaintiffs also sought to enjoin the Defendants from transferring patient information from computer systems to any portable device “until and unless Defendants demonstrate to the Court that adequate information security has been established.” J.A. 23. Finally, the Beck plaintiffs alleged separate common-law negligence claims.

The Defendants moved to dismiss for lack of subject-matter jurisdiction or, in the alternative, for failure to state a claim. The district court granted the motion as to the common-law negligence claims, but declined to dismiss the Privacy Act and APA claims.

Following extensive discovery, the Plaintiffs moved for partial summary judgment and for class certification. The Defendants renewed their motion to dismiss the Plaintiffs’ claims for lack of subject-matter jurisdiction and, in the alternative, moved for summary judgment. The district court granted the Defendants’ motion to dismiss, holding, pursuant to Clapper v. Amnesty International USA, — U.S. -, 133 S.Ct. 1138, 1155, 185 L.Ed.2d 264 (2013), that the Beck plaintiffs lacked standing under the Privacy Act because they had “not submitted evidence sufficient to create a genuine issue of material fact as to whether they face a ‘certainly impending’ risk of identity theft.” J.A. 1059.

The Beck plaintiffs’ fear of harm from future identity theft, said the district court, was too speculative to confer standing because it was “contingent on a chain of attenuated hypothetical events and actions by third parties independent of the defendants.” J.A. 1059 (citing Clapper, 133 S.Ct. at 1148). The Beck plaintiffs also failed to satisfy the “lesser standard” of “substantial risk” of future harm referenced in Clapper: The plaintiffs’ calculations that 33% of those affected by the laptop theft would have their identities stolen and that all affected would be 9.5 times more likely to experience identity theft “d[id] not suffice to show a substantial risk of identity theft.” J.A. 1060.

The district court also rejected the Beck plaintiffs’ attempt to “create standing by choosing to purchase credit monitoring services or taking any other steps designed to mitigate the speculative harm of future identity theft.” J.A. 1061. These measures, according to the court, did not amount to an injury-in-fact because they were taken solely “to mitigate a speculative future harm.” J.A. 1061.

Turning to the Beck plaintiffs’ request for injunctive relief under the APA, the district court acknowledged that the claim that “there have been at least seventeen data breaches at Dorn [VAMC] during the course of th[e] [Beck] litigation” was “undoubtedly concerning.” J.A. 1064. Nonetheless, the court concluded that Dorn VAMC’s “past Privacy Act violations are insufficient to establish Plaintiffs’ standing to seek injunctive relief’ where it was “no more than speculation for Plaintiffs to assert that their personal information will again be compromised by a future Privacy Act violation and that they will be injured as a result.” J.A. 1064.

The district court ruled in the alternative that the Defendants were entitled to summary judgment on the merits, because: (1) the Beck plaintiffs had not suffered “actual damages” as required to recover damages under the Privacy Act, and (2) the APA could not be read to “provide for the broad judicial oversight” of the VA’s entire privacy program sought by the Plaintiffs. J.A. 1067-68.

B.

The Watson case arises from Dorn VAMC’s July 2014 discovery that four boxes of pathology reports headed for long-term storage had been misplaced or stolen. The reports contain identifying information of over 2,000 patients, including names, social security numbers, and medical diagnoses. Dorn VAMC officials alerted those affected and, as they did following the laptop’s disappearance, offered each of them one year of free credit monitoring. The boxes have not been recovered.

While the Beck litigation was pending, Beverly Watson brought a putative class-action lawsuit on behalf of the over 2,000 individuals whose pathology reports had gone missing. Watson sought money damages and declaratory and injunctive relief, alleging the same harm as did the Beck plaintiffs. The Defendants moved to dismiss the complaint for lack of subject-matter jurisdiction and for failure to state a claim.

The district court granted the Defendants’ motion to dismiss for lack of subject-matter jurisdiction, relying on Clapper to hold that Watson lacked Article III standing under the Privacy Act because she “ha[d] not alleged that there ha[d] been any actual or attempted misuse of her personal information,” thus rendering her allegation that her information “will eventually be misused as a result of the disappearance of the boxes ... speculative.” J. A. 1091.

According to the district court, for Watson to suffer the injury she feared, the court would have to assume that: (1) the boxes were stolen by someone bent on misusing the personal information in the pathology reports; (2) the thief would select Watson’s report from the over 3,600 reports in the missing boxes; (3) the thief would then attempt to use or sell to others Watson’s personal information; and (4) the thief or purchaser of Watson’s information would successfully use the information in the report to steal Watson’s identity. This “attenuated chain of possibilities” did not satisfy Watson’s burden to show that her threatened injury was “certainly impending.” J.A. 1092. As it did in Beck, the district court rejected Watson’s allegations that any costs incurred to fend off future identity theft constituted an injury-in-fact.

Turning to Watson’s claim for injunctive relief under the APA, the district court concluded that her allegations, based on Dorn VAMC’s “historic inability or unwillingness to protect Plaintiffs personal information” were insufficient to show that, absent injunctive relief, she would be “in real and immediate danger of sustaining a direct injury as a result of some official conduct.” J.A. 1096.

All Plaintiffs appeal the district court’s ruling as to Article III standing. The Beck plaintiffs also appeal the district court’s alternative ruling that the Defendants are entitled to summary judgment on the Privacy Act and APA claims. Because we find that the Plaintiffs do not have Article III standing, we do not address the merits.

II.

We review de novo the district court’s decision to dismiss for lack of standing. 24th Senatorial Dist. Republican Comm. v. Alcorn, 820 F.3d 624, 628 (4th Cir. 2016).

Article III of the U.S. Constitution limits the jurisdiction of federal courts to “Cases” and “Controversies.” U.S. Const. art. III, § 2. “One element of the case-or-controversy requirement is that plaintiffs must establish that they have standing to sue.” Clapper, 133 S.Ct. at 1146 (internal citations and quotation marks omitted). To invoke federal jurisdiction, a plaintiff bears the burden of establishing the three “irreducible minimum requirements” of Article III standing:

(1) an injury-in-fact (i.e., a concrete and particularized invasion of a legally protected interest); (2) causation (i.e., a fairly traceable connection between the alleged injury in fact and the alleged conduct of the defendant); and (3) re-dressability (i.e., it is likely and not merely speculative that the plaintiffs injury will be remedied by the relief plaintiff seeks in bringing suit).

David v. Alphin, 704 F.3d 327, 333 (4th Cir. 2013) (internal alterations and quotation marks omitted).

In a class action, we analyze standing based on the allegations of personal injury made by the named plaintiffs. See Doe v. Obama, 631 F.3d 157, 160 (4th Cir. 2011) (citing Warth v. Seldin, 422 U.S. 490, 501, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975)). “Without a sufficient allegation of harm to the named plaintiff in particular, plaintiffs cannot meet their burden of establishing standing.” Id.

A defendant may challenge subject-matter jurisdiction in one of two ways: facially or factually. See Kerns v. United States, 585 F.3d 187, 192 (4th Cir. 2009). In a facial challenge, the defendant contends “that a complaint simply fails to allege facts upon which subject matter jurisdiction can be based.” Id. (quoting Adams v. Bain, 697 F.2d 1213, 1219 (4th Cir. 1982)). Accordingly, the plaintiff is “afforded the same procedural protection as she would receive under a Rule 12(b)(6) consideration,” wherein “the facts alleged in the complaint are taken as true,” and the defendant’s challenge “must be denied if the complaint alleges sufficient facts to invoke subject matter jurisdiction.” Id.

In a factual challenge, the defendant argues “that the jurisdictional allegations of the complaint [are] not true,” providing the trial court the discretion to “go beyond the allegations of the complaint and in an evidentiary hearing determine if there are facts to support the jurisdictional allegations.” Id. (first alteration in original) (quoting Adams, 697 F.2d at 1219). In this posture, “the presumption of truthfulness normally accorded a complaint’s allegations does not apply.” Id.

Critically, the procedural posture of the case dictates the plaintiffs burden as to standing. Lujan v. Defs. of Wildlife, 504 U.S. 555, 561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (“[E]ach element [of standing] must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive' stages of the litigation.”). Here, the district court dismissed Watson on the pleadings and Beck at summary judgment.

“At the pleading stage, general factual allegations of injury resulting from the defendant’s conduct may suffice, for on a motion to dismiss we presume that general allegations embrace those specific facts that are necessary to support the claim.” Id. (internal citations omitted). As such, we accept as true Watson’s allegations for which there is sufficient “factual matter” to render them “plausible on [their] face.” See Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (internal citations omitted). We do not, however, apply the same presumption of truth to “conclusory statements” and “legal conclusions” contained in Watson’s complaint. See id.; Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555-56, 127 S.Ct. 1955 (2007).

By contrast, having developed through discovery a summary judgment record, the Beck plaintiffs are not entitled to “rest on such mere allegations, but must set forth by affidavit or other evidence specific facts, which for purposes of the summary judgment motion will be taken to be true.” Lujan, 504 U.S. at 561, 112 S.Ct. 2130 (citing Fed. R. Civ. P. 56) (internal quotations omitted).

III.

A.

We focus our inquiry on the first element of Article III standing: injury-in-fact. “To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’ ” Spokeo, Inc. v. Robins, — U.S. -, 136 S.Ct. 1540, 1548, 194 L.Ed.2d 635 (2016) (quoting Lujan, 504 U.S. at 560, 112 S.Ct. 2130). And while it is trae “that threatened rather than actual injury can satisfy Article III standing requirements,” Friends of the Earth, Inc. v. Gaston Copper Recycling Corp., 204 F.3d 149, 160 (4th Cir. 2000) (en banc), not all threatened injuries constitute an injury-in-fact. Rather, as the Supreme Court has “emphasized repeatedly,” an injury-in-fact “must be concrete in both a qualitative and temporal sense.” Whitmore v. Arkansas, 495 U.S. 149, 155, 110 S.Ct. 1717, 109 L.Ed.2d 135 (1990). “The complainant must allege an injury to himself that is distinct and palpable, as opposed to merely abstract.” Id. (internal citations and quotations omitted). “Although ‘imminence’ is concededly a somewhat elastic concept, it cannot be stretched beyond its purpose, which is to ensure that the alleged injury is not too speculative for Article III purposes.” Lujan, 504 U.S. at 564-65, n. 2, 112 S.Ct. 2130.

The Court recently explored the “threatened injury” theory of Article III standing in Clapper v. Amnesty International USA. That case involved a constitutional challenge to section 1881a of the Foreign Intelligence Surveillance Act of 1978 (“FISA”), which, “upon the issuance of an order from the Foreign Intelligence Surveillance Court,” authorizes “for a period of up to 1 year” the Attorney General and the Director of National Intelligence to target for surveillance “persons reasonably believed to be located outside the United States to acquire foreign intelligence information.” 133 S.Ct. at 1144 (quoting 50 U.S.C. § 1881a).

The respondents — attorneys and human-rights, labor, legal, and media organizations whose work required them to communicate via telephone and e-mail with individuals located abroad — sought a declaration that the provision was facially unconstitutional and a permanent injunction against its use. Id. at 1146. The respondents alleged two injuries: (1) that § 1881a curtailed their ability to “locate witnesses, cultivate sources, obtain information, and communicate confidential information,” and (2) that they had implemented “costly and burdensome measures,” including traveling abroad to have in-person conversations, to protect the confidentiality of their sensitive communications .from FISA surveillance. Id. at 1145-46.

. The district court ruled that the respondents lacked standing. Id. at 1146. On appeal, the Second Circuit reversed, holding that the “objectively reasonable likelihood” that the respondents’ communications would be intercepted at some future time and their allegation that they suffered economic and professional harm as a result were sufficient to confer standing. Id.

The Supreme Court rejected the Second Circuit’s use of an “objectively reasonable likelihood” standard for Article III standing as inconsistent with the Court’s long-established requirement that “threatened injury must be certainly impending to constitute injury in fact.” Id. at 1147-48 (listing cases). Addressing first the respondents’ allegation that the Government would target their private communications, the Court catalogued the series of hypothetical events that would have to occur to establish an “imminent” injury-in-fact: namely, the speculative possibility that the Government, pursuant to § 1881a’s “many safeguards,” would successfully target and intercept the communications of those foreigners with whom the respondents worked. Id. at 1148-50. The respondents’ theory of standing, premised on this “highly attenuated chain of possibilities” could not “satisfy the requirement that threatened injury must be certainly impending.” Id. at 1148.

The respondents’ second theory of injury, premised on the “costly and burdensome” measures they had undertaken to protect the confidentiality of their communications, also failed to confer standing. Id. at 1150-51. The Court reasoned that the respondents’ attempts to minimize e-mail and phone conversations, to speak “in generalities rather than specifics,” and to travel abroad to have in-person conversations, were all costs “incurred in response to a speculative threat.” Id. at 1151. The Court declined to “water[ ] down the fundamental requirements of Article III” by allowing respondents to “manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” Id.

Clapper’s discussion of when a threatened injury constitutes an Article III injury-in-fact is controlling here. Before explaining why, we address the Plaintiffs’ contention that the district court misread Clapper to require a new, heightened burden for proving an Article III injury-in-fact. To the contrary, Clapper’s iteration of the well-established tenet that a threatened injury must be “certainly impending” to constitute an injury-in-fact is hardly novel. E.g., DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 345, 126 S.Ct. 1854, 164 L.Ed.2d 589 (2006) (an asserted injury is “imminent” when it is “certainly impending”); Lujan, 504 U.S. at 564-65, n.2, 112 S.Ct. 2130 (same); Whitmore, 495 U.S. at 158, 110 S.Ct. 1717 (“A threatened injury must be ‘certainly impending’ to constitute injury in fact.”).

We also reject the Plaintiffs’ claim that “emotional upset”' and “fear [of] identity theft and financial fraud” resulting from the data breaches are “adverse effects” sufficient to confer Article III standing. Appellants’ Br. at 22 (citing 5 U.S.C. § 552a(e)(10)). That assertion reflects a misunderstanding of the Privacy Act and is an overextension of Doe v. Chao, 540 U.S. 614, 124 S.Ct. 1204, 157 L.Ed.2d 1122 (2004).

The sole issue in Chao was whether a Privacy Act plaintiff must prove actual damages to qualify for the minimum statutory award of $1,000. 540 U.S. at 616, 124 S.Ct. 1204. There, a black-lung claimant brought suit under the Privacy Act against the Department of Labor for improperly disclosing his social security number. Id. at 617, 124 S.Ct. 1204. This court held that the Department was entitled to summary judgment, concluding that the claimant had failed to raise a triable issue of fact about actual damages because he had submitted no corroboration for his claim of emotional distress. Id. The Supreme Court affirmed, reasoning that “a straightforward textual analysis” of the Privacy Act required a plaintiff to prove actual damages from an intentional or willful violation of the Act to qualify for the award. Id. at 620, 124 S.Ct. 1204.

As the Court explained in Chao, “the reference in [the Privacy Act] to ‘adverse effect’ [is] a term of art identifying a potential plaintiff who satisfies the injury-in-fact and causation requirements of Article III standing.” 540 U.S. at 624, 124 S.Ct. 1204 (emphasis added). We decline to interpret dicta in Chao discussing the plaintiffs “conelusory allegations” that he was “torn ... all to pieces” by the unauthorized disclosure of his social security number as support for the proposition that bare assertions of emotional injury are sufficient to confer Article III standing. Id. at 617, 624-25, 124 S.Ct. 1204. This court is “bound by holdings” of the Supreme Court, not its “unwritten assumptions.” Fernandez v. Keisler, 502 F.3d 337, 343-44, n.2 (4th Cir. 2007).

Accordingly, with ClappeP s tenets firmly in tow, we address the two grounds for Article III standing pressed by the Plaintiffs for their Privacy Act claims: (1) the increased risk of future identity theft, and (2) the costs of protecting against the same.

Increased Risk of Future Identity Theft

Our sister circuits are divided on whether a plaintiff may establish an Article III injury-in-fact based on an increased risk of future identity theft. The Sixth, Seventh, and Ninth Circuits have all recognized, at the pleading stage, that plaintiffs can establish an injury-in-fact based on this threatened injury. See Galaria v. Nationwide Mut. Ins. Co., No. 15-3386, 663 Fed.Appx. 384, 387-89, 2016 WL 4728027, at *3 (6th Cir. Sept. 12, 2016) (plaintiff-customers’ increased risk of future identity theft theory established injury-in-fact after hackers breached Nationwide Mutual Insurance Company’s computer network and stole their sensitive personal information, because “[t]here is no need for speculation where Plaintiffs allege that their data has already been stolen and is now in the hands of ill-intentioned criminals”); Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 692, 694-95 (7th Cir. 2015) (plaintiff-customers’ increased risk of future fraudulent charges and identity theft theory established “certainly impending” injury-in-fact and “substantial risk of harm” after hackers attacked Neiman Marcus with malware to steal credit card numbers, because “[presumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers’ identities”); Krottner v. Starbucks Corp., 628 F.3d 1139, 1142-43 (9th Cir. 2010) (plaintiff-employees’ increased risk of future identity theft theory a “credible threat of harm” for Article III purposes after theft of a laptop containing the unencrypted names, addresses, and social security numbers of 97,000 Starbucks employees); Pisciotta v. Old Nat’l Bancorp, 499 F.3d 629, 632-34 (7th Cir. 2007) (banking services applicants’ increased risk of harm theory satisfied Article III injury-in-fact requirement after “sophisticated, intentional and malicious” security breach of bank website compromised their information).

By contrast, the First and Third Circuits have rejected such allegations. See Katz v. Pershing, LLC, 672 F.3d 64, 80 (1st Cir. 2012) (brokerage account-holder’s increased risk of unauthorized access and identity theft theory insufficient to constitute “actual or impending injury” after defendant failed to properly maintain an electronic platform containing her account information, because plaintiff failed to “identify any incident in which her data has ever been accessed by an unauthorized person”); Reilly v. Ceridian Corp., 664 F.3d 38, 40, 44 (3d Cir. 2011) (plaintiff-employees’ increased risk of identity theft theory too hypothetical and speculative to establish “certainly impending” injury-in-fact after unknown hacker penetrated payroll system firewall, because it was “not known whether the hacker read, copied, or understood” the system’s information and no evidence suggested past or future misuse of employee data or that the “intrusion was intentional or malicious”).

The Plaintiffs say that our sister circuits’ decisions in Krottner, Pisciotta, and Remijas support their allegations of standing based on threatened injury of future identity theft. To the contrary, these cases demonstrate why the Plaintiffs’ theory is too speculative to constitute an injury-in-fact.

Underlying the cases are common allegations that sufficed to push the threatened injury of future identity theft beyond the speculative to the sufficiently imminent. In Galaria, Remijas, and Pisciotta, for example, the data thief intentionally targeted the personal information compromised in the data breaches. Galaria, 663 Fed.Appx. at 386, 2016 WL 4728027, at *1 (“[H]ackers broke into Nationwide’s computer network and stole the personal information of Plaintiffs and 1.1 million others.”); Remijas, 794 F.3d at 694 (“Why else would hackers break into a store’s database and steal consumers’ private information?”); Pisciotta, 499 F.3d at 632 (“scope and manner” of intrusion into banking website’s hosting facility was “sophisticated, intentional and malicious”). And, in Remijas and Krottner, at least one named plaintiff alleged misuse or access of that personal information by the thief. Remijas, 794 F.3d at 690 (9,200 of the 350,000 credit cards potentially exposed to malware “were known to have been used fraudulently”); Krottner, 628 F.3d at 1141 (named plaintiff alleged that, two months after theft of laptop containing his social security number, someone attempted to open a new account using his social security number).

Here, the Plaintiffs make no such claims. This in turn renders their contention of an enhanced risk of future identity theft too speculative. On this point, the data breaches in Beck and Watson occurred in February 2013 and July 2014, respectively. Yet, even after extensive discovery, the Beck plaintiffs have uncovered no evidence that the information contained on the stolen laptop has been accessed or misused or that they have suffered identity theft, nor, for that matter, that the thief stole the laptop with the intent to steal their private information. Watson’s complaint suffers from the same deficiency with regard to the four missing boxes of pathology reports. Moreover, “as the breaches fade further into the past,” the Plaintiffs’ threatened injuries become more and more speculative. See Chambliss v. Carefirst, Inc., 189 F.Supp.3d 564, 570 (D. Md. 2016); In re Zappos.com, 108 F.Supp.3d 949, 958 (D. Nev. 2015) (“[T]he passage of time without a single report from Plaintiffs that they in fact suffered the harm they fear must mean something.”).

The Plaintiffs counter that there is “no need to speculate” here because they have alleged — and in the Beck case the VA’s investigation concluded — that the laptop and pathology reports had been stolen. See J.A. 824. We of course accept this allegation as true. But the mere theft of these items, without more, cannot confer Article III standing. See Randolph v. ING Life Ins. & Annuity Co., 486 F.Supp.2d 1, 7-8 (D.D.C. 2007) (deeming as speculative plaintiffs’ allegations “that at some unspecified point in the indefinite future they will be the victims of identity theft” where, although plaintiffs clearly alleged their information was stolen by a burglar, they did “not allege that the burglar who stole the laptop did so in order to access their [ijnformation, or that their [ijnformation ha[d] actually been accessed since the laptop was stolen”).

Indeed, for the Plaintiffs to suffer the harm of identity theft that they fear, we must engage with the same “attenuated chain of possibilities” rejected by the Court in Clapper. 133 S.Ct. at 1147-48. In both cases, we must assume that the thief targeted the stolen items for the personal information they contained. And in both cases, the thieves must then select, from thousands of others, the personal information of the named plaintiffs arid attempt successfully to use that information to steal their identities. This “attenuated chain” cannot confer standing.

The Plaintiffs insist that the district court required them to show “concrete evidence that [their] personal information had already been misused,” thus forcing someone in their position “‘to wait for the threatened harm to materialize in order to sue.’ ” Appellants’ Br. at 28 (quoting Remijas, 794 F.3d at 694). We disagree. The district court sought only to hold the Plaintiffs to their respective burdens to either “plausibly plead” factual allegations or “set forth particular evidence” sufficient to show that the threatened harm of future identity theft was “certainly impending.” This they failed to do.

Nonetheless, our inquiry on standing is not at an end, for we may also find standing based on a “substantial risk” that the harm will occur, which in turn may prompt a party to reasonably incur costs to mitigate or avoid that harm. Clapper, 133 S.Ct. at 1150 n.5. But here too the Plaintiffs fall short of their burden.

The Plaintiffs allege that: (1) 33% of health-related data breaches result in identity theft; (2) the Defendants expend millions of dollars trying to avoid and mitigate those risks; and (3) by offering the Plaintiffs free credit monitoring, the VA effectively conceded that the theft of the laptop and pathology reports constituted a “reasonable risk of harm to those victimized” by the data breaches. Appellants’ Br. at 31 (citing 38 C.F.R. § 75.116 (authorizing Secretary of Veterans Affairs to offer credit protection services for mitigative purposes upon finding that “reasonable risk exists” for “potential misuse of sensitive personal information” compromised in a data breach)).

These allegations are insufficient to establish a “substantial risk” of harm. Even if we credit the Plaintiffs’ allegation that 33% of those affected by Dorn VAMC data breaches will become victims of identity theft, it follows that over 66% of veterans affected will suffer no harm. This statistic falls far short of establishing a “substantial risk” of harm. E.g., Khan v. Children’s Nat’l Health Sys., 188 F.Supp.3d 524, 533 (D. Md. 2016) (“general allegations ... that data breach victims are 9.5 times more likely to suffer identity theft and that 19 percent of data breach victims become victims of identity theft” insufficient to establish “substantial risk” of harm); In re Sci Applications Int'l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F.Supp.3d 14, 26 (D.D.C. 2014) (no “substantial risk” of harm where “[b]y Plaintiffs own calculations, then, injury is likely not impending for over 80% of victims”).

The Plaintiffs’ other allegations fare no better. Contrary to some of our sister circuits, we decline to infer a substantial risk of harm of future identity theft from an organization’s offer to provide free credit monitoring services to affected individuals. To adopt such a presumption would surely discourage organizations from offering these services to data-breach victims, lest their extension of goodwill render them subject to suit.

Further, we read Clapper’s rejection of the Second Circuit’s attempt to import an “objectively reasonable likelihood” standard into Article III standing to express the common-sense notion that a threatened event can be “reasonably] likelfy]” to occur but still be insufficiently “imminent” to constitute an injury-in-fact. See 133 S.Ct. at 1147-48. Accordingly, neither the VA’s finding that a “reasonable risk exists” for the “potential misuse of sensitive personal information” following the data breaches, nor its decision to pay for credit monitoring to guard against it is enough to show that the Defendants subjected the Plaintiffs to a “substantial risk” of harm.

Cdst of Mitigative Measures

Next, we turn to the Plaintiffs’ allegation that they have suffered an injury-in-fact because they have incurred or will in the future incur the cost of measures to guard against identity theft, including the costs of credit monitoring services. All Plaintiffs allege that they wish to enroll in, are enrolled in, or have purchased credit monitoring services. They also say that, as a consequence of the breaches, they have incurred the burden of monitoring their financial and credit information. Even accepting these allegations as true, they do not constitute an injury-in-fact.

As was the case in Clapper, the Plaintiffs here seek “to bring this action based on costs they incurred in response to a speculative threat,” i.e. their fear of future identity theft based on the breaches at Dorn VAMC. Id. at 1151. But this allegation is merely “a repackaged version of [Plaintiffs’] first failed theory of standing.” Id. Simply put, these self-imposed harms cannot confer standing. See, e.g., Remijas, 794 F.3d at 694 (“Mitigation expenses do not qualify as actual injuries where the harm is not imminent.”); Reilly, 664 F.3d at 46 (“[P]rophylactically spen[ding] money to ease fears of [speculative] future third-party criminality ... is not sufficient to confer standing.”).

B.

Finally, we address the Plaintiffs’ request for broad injunctive relief under the APA. To establish their standing to seek such relief, the Plaintiffs borrow from the statutory language of the Privacy Act, contending that the “substantial harm,” “embarrassment,” “inconvenience,” and “unfairness” caused them by the Defendants satisfies their Article III burden because they have been “adversely affected” within the meaning of the APA. See 6 U.S.C. §§ 552a(e)(10), 702.

These citations to the Privacy Act’s language are inapposite: The APA’s “adversely affected” language does not relieve the Plaintiffs of their burden to prove Article III standing. See Match-E-Be-Nash-She-Wish Band of Pottawatomi Indians v. Patchak, 567 U.S. 209, 132 S.Ct. 2199, 2210, 183 L.Ed.2d 211 (“[A] person suing under the APA must satisfy not only Article Ill’s standing requirements,” but also the prudential “zone of interests” test) (internal quotations omitted). Rather, we agree with the district court that the Plaintiffs do not have standing to seek injunc-tive relief under the APA because allegations of Dorn VAMC’s past Privacy Act violations are insufficient to establish an ongoing case or controversy. See City of Los Angeles v. Lyons, 461 U.S. 95, 101-02, 103 S.Ct. 1660, 75 L.Ed.2d 675 (1974) (“[P]ast exposure to illegal conduct does not in itself show a present case or controversy regarding injunctive relief.”) (internal quotations omitted).

“A plaintiff who seeks ... to enjoin a future action must demonstrate that he ‘is immediately in danger of sustaining some direct injury’ as the result of the challenged official conduct.” Lebron v. Rumsfeld, 670 F.3d 540, 560 (4th Cir. 2012) (quoting Lyons, 461 U.S. at 102, 103 S.Ct. 1660). And this “threat of injury must be both ‘real and immediate,’ not ‘conjectural’ or ‘hypothetical.’” Id. The Plaintiffs say that Dorn VAMC’s “inadequate actions and inactions will repeatedly harm every veteran regardless of anything those individuals can do” where Dorn VAMC “has never been in compliance with the Privacy Act,” and where there is “no factual basis to believe VA will ever achieve compliance with safeguards requirements left to its own devices.” Appellants’ Br. at 38-39.

We acknowledge that the named plaintiffs have been victimized by “at least two admitted VA data breaches,” and that Ms. Watson’s information was compromised in both the 2013 laptop theft and the 2014 pathology reports theft. Appellants’ Br. at 39. But “[a]bsent a sufficient likelihood that [Plaintiffs] will again be wronged in a similar way,” Lyons, 461 U.S. at 111, 103 S.Ct. 1660, these past events, disconcerting as they may be, are not sufficient to confer standing to seek injunctive relief. See Le-brón, 670 F.3d at 560-61 (affirming dismissal of former enemy combatant detainee’s request for injunction against future designation as an enemy combatant because the mere “possibility” of re-designation was insufficient to allege a “real” and “immediate” threat). The most that can be reasonably inferred from the Plaintiffs’ allegations regarding the likelihood of another data breach at Dorn VAMC is that the Plaintiffs could be victimized by a future data breach. That alone is not enough.

IV.

For the reasons given, the judgments of the district court are

AFFIRMED.

      . The Beck plaintiffs later amended their complaint to add as named plaintiffs Beverly Watson, Cheryl Gajadhar, and- Jeffery Willhite.

      . Ms. Watson is also a named plaintiff in Beck.

      . We granted an unopposed motion to consolidate the cases.

      . In Spokeo, the Supreme Court suggested that some violations of the Fair Credit Reporting Act ("FCRA”), though "intangible” harms, may still be sufficiently "concrete” to establish an Article III injury-in-fact. 136 S.Ct. at 1549-50. In Spokeo's aftermath, some plaintiffs have attempted to establish Article III standing by alleging that the violation of a privacy statute, in and of itself, is sufficiently "concrete” to establish an “injury-in-fact,” to varying result. Compare In re Horizon Healthcare Servs. Inc. Data Breach Litig., No. 15-2309, 846 F.3d 625, 640-41, 2017 WL 242554, at *11 (3d Cir. Jan. 20, 2017) ("[T]he unauthorized dissemination of ... private information — the very injury that FCRA is intended to prevent ... [is] a de facto injury that satisfies the concreteness requirement for Article III standing.”) with Gubala v. Time Warner Cable, Inc., No. 16-2613, 846 F.3d 909, 913, 2017 WL 243343, at *4 (7th Cir. Jan. 20, 2017) (plaintiff’s failure to allege or provide evidence of any concrete injury inflicted or likely to be inflicted on the plaintiff as a consequence of Time Warner's continued retention of his personal information in violation of the Cable Communications Policy Act insufficient to confer Article III standing). Spokeo is not controlling here, as the Plaintiffs do not allege that Dorn VAMC’s violations of the Privacy Act alone constitute an Article III injury-in-fact.

      . The Plaintiffs also rely on the environmental law cases of Friends of the Barth, Inc. v Laidlaw Environmental Services, 528 U.S. 167, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000) and Friends of the Earth, Inc. v. Gaston Copper Recycling Corp., 629 F.3d 387, 394 (4th Cir. 2011) (en banc) to support their view that a "reasonable concern” of harm is sufficient to confer Article III standing. Appellants’ Br. at 23. "In the environmental litigation context, [however], the standing requirements are not onerous.” Am. Canoe Ass'n v. Murphy Farms, Inc., 326 F.3d 505, 517 (4th Cir. 2003). This is so because "[t]he extinction of a species, the destruction of a wilderness habitat, or the fouling of air and water are harms that are frequently difficult or impossible to remedy" by monetary compensation. Cent. Delta Water Agency v. United States, 306 F.3d 938, 950 (9th Cir. 2002). By contrast, in data-breach cases, "there is no reason to believe that monetary compensation will not return plaintiffs to their original position completely.” Reilly, 664 F.3d at 45.

      . Ms. Gajadhar, a named Beck plaintiff, testified to three unauthorized credit card charges, later reimbursed by her bank. However, she failed to attribute those charges to the 2013 laptop theft. Nor could she, given that the data on the stolen laptop did not contain any credit card or bank account information.

      . The Plaintiffs’ claim that data-breach victims are 9.5 times more likely than the average person to suffer identity theft does not alter our conclusion. As the Defendants point out, this general statistic says nothing about the risk arising out of any particular incident, nor does it address the particular facts of this case.

      . See, e.g., Galaria, 663 Fed.Appx. at 388, 2016 WL 4728027, at *3 (“Indeed, Nationwide seems to recognize the severity of the risk, given its offer to provide credit-monitoring and identity-theft protection for a full year.”); Remijas, 794 F.3d at 694 (“It is telling ... that Neiman Marcus offered one year of credit monitoring and identity-theft protection to all [potentially affected] customers. It is unlikely that it did so because the risk is so ephemeral that it can safely be disregarded.”).

      . We assume without deciding that injunctive relief is available in these circumstances.


source: Caselaw Access Project

author: AGEE, Circuit Judge:

license: Public Domain

text:
    Nancy LOFTUS, Plaintiff-Appellant, v. David BOBZIEN, County Attorney, Fairfax County; Edward L. Long, County Executive, Fairfax County, Defendants-Appellees.
    No. 15-2164
    United States Court of Appeals, Fourth Circuit.
    Argued: October 25, 2016
    Decided: February 8, 2017

      ARGUED: John Chapman Petersen, SUROVELL ISAACS PETERSEN & LEVY PLC, Fairfax, Virginia, for Appellant. Sona Rewari, HUNTON & WILLIAMS LLP, McLean, Virginia, for Appellees. ON BRIEF: Jason Frank Zell-man, SUROVELL ISAACS PETERSEN & LEVY PLC, Fairfax, Virginia, for Appellant.
    Before AGEE, DIAZ, and THACKER, Circuit Judges.
   AGEE, Circuit Judge:

David Bobzien (“Bobzien”), the County Attorney for Fairfax County, Virginia, terminated the employment of Nancy Loftus (“Loftus”), an assistant county attorney, following her election to the Fairfax City, Virginia, City Council (the “City Council”). After an unsuccessful grievance proceeding, Loftus filed suit in the United States District Court for the Eastern District of Virginia, challenging Bobzien’s decision to terminate her employment “solely because she had been elected to the City Council.” J.A. 4. Loftus contended Bobzien’s actions violated her rights under the First Amendment to the United States Constitution as well as a Virginia statute and Fairfax County ordinance. The district court dismissed Loftus’ complaint, concluding the termination of her employment did not violate the First Amendment, Virginia law or the local ordinance. For the reasons set out below, we affirm the district court’s judgment.

I.

From 1997 until her termination in 2014, Loftus was employed by the Fairfax County Attorney’s Office as an assistant county attorney. In early 2014, Loftus contemplated becoming a candidate for the Fair-fax City Council, the governing body of a separate and independent municipality from Fairfax County under Virginia law. See Va. Const. art. VII, § 2; Va. Code Ann. § 15.2-204. In February 2014, Loftus told Bobzien she was “considering a run” for the City Council in an election scheduled for May 2014. J.A. 10. As of February 2014, however, she had not announced her candidacy and had not formally filed to become a candidate.

Bobzien initially expressed misgivings about Loftus’ intentions, stating in an email to her that election to the City Council might conflict with her responsibilities as an assistant county attorney because the County Attorney’s Office “routinely ha[s] dealings with the City that can lead to contention.” J.A. 27. At the time, Fairfax County and Fairfax City had a number of “ongoing business, contractual and governmental relationships,” including “numerous agreements and memoran-da of understanding” that provided for services such as “police, fire, library, health, welfare and social services, and sanitary sewer and waste disposal.” J.A. 32. In response to Bobzien’s concerns, Loftus represented that she had “never been involved in any case against, or even with, the City” in her duties as an assistant county attorney. J.A. 26.

On April 17, 2014, once Loftus had become an official candidate for City Council, Bobzien sent her an extensive and thorough letter that again expressed concern about the conflict of interest that Loftus’ election to the City Council would create. In particular, the letter noted that if Lof-tus were to win the election, her duties as a member of the City Council would conflict with her responsibilities as an assistant county attorney because of the numerous legal relationships between the City and County. Bobzien also expressed concern that Loftus’ conflict of interest would be imputed to every attorney in the Fairfax County Attorney’s Office. In that circumstance, all of the County’s attorneys would be prevented from representing Fairfax County not only in court proceedings adverse to Fairfax City but also in civil matters. In view of that apparent conflict, Bobzien cautioned Loftus that “if you decide to continue to pursue your election to the City Council, and you are successful, you will not be able to continue your employment with this Office once you take office as a member of the Fairfax City Council.” J.A. 32.

In conveying his concerns to Loftus in the April 17 letter, Bobzien referenced Virginia’s Rules of Professional Conduct (the “Rules”) and three legal ethics opinions (“LEOs”) from the Virginia State Bar’s Standing Committee on Legal Ethics (the “Standing Committee”) interpreting the Rules: LEO 1718, LEO 1763, and LEO 1773. In relevant part, LEO 1718 provides that “if a law firm represents clients before a governing body when one of its lawyers is a member, there is the appearance, if not the fact, of conflicting loyalties.” J.A. 50. LEO 1718 explains the ethical dilemma for the lawyer-legislator:

The law firm, which includes the lawyer who sits on the governing body, owes a duty of loyalty to the client and must use all available resources to achieve the client’s lawful objective. The duty of loyalty is diluted and the available resources impaired, however, when the law firm must exclude the lawyer-legislator from the representation, and the law firm cannot enlist his knowledge of the subject matter or of the governing body in the representation. The lawyer-legislator may have acquired non-public or even confidential information as a member of the governing body that would serve the client’s interest. The client is denied the benefit of such information, however. If the law firm seeks client-consent to the limitation on its resources, the law firm might well be asking for consent to less than adequate representation.
Similarly, the lawyer-legislator has a duty to the governing body on which he/she serves and to his/her constituents. When he/she abstains from the governing body’s decision-making because it involves his/her law firm’s representation of a client, then his/her personal interest is elevated over his/her duty as a public servant. Both the governing body and the lawyer-legislator’s constituents are deprived of the benefit of his/her voice in the decision-making process.

J.A. 50. The LEO concludes “it is not ethically permissible for a law firm to represent a client in a matter before a governing body when one of the law firm’s lawyers is a member of the governing body even if he/she discloses the conflict and abstains from participation and voting in the matter.” J.A. 50.

In LEO 1763, the Standing Committee reaffirmed LEO 1718 and concluded: “for an attorney/board member to recuse himself from a matter before his board in order that his law firm may accept representation of a private client creates an impermissible conflict of interest.... [and, thus,] an attorney may not accept representation of a client in a matter that would require an appearance before a board, or other public body, of which any member of that attorney’s firm is a member.” J.A. 52. Finally, in LEO 1773, the Standing Committee referenced LEO 1718 and LEO 1763 as describing an “obvious” conflict, which cannot be cured by recusal because “recusal would violate the attorney/board member’s obligations to his constituents.” J.A. 53. Based on those LEOs, Bobzien concluded Loftus’ election to the City Council would create a similar and intractable conflict of interest both for her and the Fairfax County Attorney’s Office, as she had been advised in the April 17 letter.

In response to Bobzien’s concerns, Lof-tus contacted the “Ethics Hotline” of the office of the Virginia State Bar’s Ethics Counsel (“Ethics Counsel”). She inquired: “is it unethical for me to be an [assistant [c]ounty [attorney for Fairfax County and also serve on the Fairfax City Council?” J.A. 57. Answering by letter, Ethics Counsel stated that the “short answer” is “it is not per se unethical for a lawyer to be employed in a law firm or government attorney’s office and concurrently hold a public position or office.” J.A. 57. Ethics Counsel then qualified his abstract answer by cautioning “lawyers that serve on public bodies will create conflicts of interest if the law firm in which the public official practices also interacts with the public body on which one of its lawyers sits.” J.A. 57. The letter continued:

LEOs 1718 and 1763 address this type of conflict and further opine that the public official’s disclosure, recusal and non-participation in the matter brought by her law firm does not cure the conflict from a legal ethics standpoint while recognizing that state and local government officials’ conflicts of interest laws are satisfied by those curative measures. In other words, lawyers that hold public office are held to a stricter standard than non-lawyers holding public office.

J.A. 57. Ethics Counsel concluded that “[t]his [stricter standard] is not new and has been repeatedly emphasized by the Standing Committee on Legal Ethics going back to opinions issued long before LEOs 1718.and 1763, although those opinions provide the best guidance and analyses of the issue.” J.A. 57. Notwithstanding these ethical “red flags,” Loftus proceeded with her candidacy — and was elected to the City Council in May 2014.

Following his April 17 letter, Bobzien confirmed his understanding of the relevant Rules with his own inquiry to the Virginia State Bar. But unlike Loftus’ “hotline” request, Bobzien requested an informal advisory opinion from the Standing Committee. In particular, he asked the Standing Committee whether the Rules “prevent an assistant county attorney from continuing to represent a county board of supervisors upon becoming a member of the city council of a city with which the county has and will have ongoing business mattersf.]” J.A. 102. In addition, he asked, if the Rules did prevent an assistant county attorney from holding those two roles, whether the Rules “also prevent the other attorneys in the county attorney’s offide from representing the county board in business matters with the city.” J.A. 102. In response, on May 14, 2014, the Standing Committee determined Bobzien’s request did not “present previously unresolved issues” and stated that “LEO 1718 and LEO 1763 are dispositive of your inquiry.” J.A. 136.

Following Loftus’ election to the City Council, but before she was to take office, Bobzien placed her on paid administrative leave. Bobzien again explained .that if Loftus were to assume her position on the City Council it would “create[ ] a conflict of interest” and that such conflict “[would be] imputed to every attorney in th[e] [County Attorney’s] Office” for the reasons identified by the Standing Committee and various LEOs. J.A. 61. He also stated that her continued employment would “violate [Fairfax] County’s Personnel Regulation 4.16,” which prohibits any County employee from holding any position that “may have the effect of reducing the efficiency of such employee.” J.A. 61, 64. Nevertheless, Loftus was sworn in as a member of the City Council on June 24, 2014, in advance of the actual commencement of her term on July 1, 2014. Consequently, Bobzien terminated her employment with Fairfax County effective June 30, 2014.

II.

A.

Loftus filed a grievance in July 2014 challenging the grounds for her termination. Loftus’ grievance first was heard internally, in the Fairfax County Attorney’s Office, and she was denied reinstatement. Loftus eventually appealed her termination to the Fairfax County Civil Service Commission (the “Commission”). In March 2015, the Commission affirmed Loftus’ termination, but also “suggested] that [Fairfax] County determine whether there are any suitable, vacant County positions for which Ms. Loftus is qualified.” J.A. 217.

In the meantime, Loftus also challenged the grievance procedures used by the Fairfax County Attorney’s Office before County Executive Edward Long (“Long”). Long affirmed the procedures used by the Fairfax County Attorney’s Office.

B.

After exhausting her administrative remedies, Loftus filed this action in the district court, alleging she had been terminated “solely because she had been elected to the City Council” and her termination was retaliatory, in violation of her First Amendment rights as enforced by 42 U.S.C. § 1983. J.A. 4. In addition, she alleged her termination violated Virginia Code § 15.2-1512.2 and Fairfax County Ordinance § 3-1-19, both of which secure a public employee’s right to participate in certain “political activities.” Loftus sought declaratory and injunctive relief, as well as $6,000,000 in damages.

On Bobzien’s motion, the district court dismissed Loftus’ complaint under Rule 12(b)(6) for failure to state a claim. As to her First Amendment claim, the court ruled Loftus’ termination “due to a perceived conflict of interest” did not violate her First Amendment rights and distinguished her claim from one where an employee was terminated “because she chose to run for office, because of any positions she espoused when running for office, or for being elected.” J.A. 692. The district court also dismissed her state law claims, concluding neither Virginia Code § 15.2-1512.2 nor Fairfax County Ordinance § 3-1-19 created a private right of action. In addition, the court concluded that neither of those enactments actually protected the holding of a public office by a public employee.

Loftus timely appealed the district court’s decision. We have jurisdiction pursuant to 28 U.S.C. § 1291.

III.

On appeal, Loftus contends the district court erred in dismissing her claims under Rule 12(b)(6). We review such dismissals de novo. Edwards v. City of Goldsboro, 178 F.3d 231, 243 (4th Cir. 1999). To survive a motion to dismiss, a complaint must provide “enough facts to state a claim to relief that is plausible on its face,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007), meaning that it must “plead[ ] factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). “[P]laintiffs may proceed into the litigation process only when their complaints are justified by both law and fact.” Francis v. Giacometti, 588 F.3d 186, 193 (4th Cir. 2009).

A.

“Section 1983 imposes liability on state actors who cause the deprivation of any rights, privileges, or immunities secured by the Constitution.” Doe v. Rosa, 795 F.3d 429, 436 (4th Cir. 2015). To state a claim under § 1983 a plaintiff “must allege the violation of a right secured by the Constitution and laws of the United States, and must show that the alleged deprivation was committed by a person acting under color of state law.” Crosby v. City of Gastonia, 635 F.3d 634, 639 (4th Cir. 2011).

Loftus raises what we understand to be two First Amendment arguments on appeal. First, Loftus appears to contend that she has an unfettered and inherent First Amendment right to hold public office, which was violated when Bobzien terminated her employment. In addition, Loftus posits that she prevails under Pickering v. Board of Education, 391 U.S. 563, 88 S.Ct. 1731, 20 L.Ed.2d 811 (1968), when her First Amendment rights, whatever they may be, are balanced against the concerns of her employer. Loftus’ arguments blend together to a degree, and, by necessity, our analysis of those arguments is duplica-tive in some regards.

1.

Loftus initially contends the termination of her employment violated her First Amendment right to hold elected office. Although we have never recognized a First Amendment right to hold elected office, we need not decide whether such a right exists to resolve this case. As a lengthy jurisprudential history makes clear, public employees who desire to hold elected office face restrictions different from those faced by non-public employees by virtue of the special trust and responsibilities of being a public employee. This is particularly true for lawyer-legislators who are public employees, as they are further bound by the ethical requirements of their profession.

Seventy years ago, the Supreme Court affirmed that a government-employer may circumscribe the rights of its employees to engage in political activity. See United Pub. Workers of Am. v. Mitchell, 330 U.S. 75, 99, 67 S.Ct. 556, 91 L.Ed. 754 (1947). As the Court put it then, a police officer “may have a constitutional right to talk politics, but he has no constitutional right to be a policeman.” Id. at 99 n.34, 67 S.Ct. 556 (quoting McAuliffe v. New Bedford, 155 Mass. 216, 29 N.E. 517, 517 (1892) (Holmes, J.)). Since that time, the Court has consistently approved various restrictions on a wide array of political activity by public employees, including running for or holding public office. See id. at 78, 67 S.Ct. 556 (upholding federal statute barring federal employees “from taking any active part in political management or in political campaigns”); see also Broadrick v. Oklahoma, 413 U.S. 601, 606, 93 S.Ct. 2908, 37 L.Ed.2d 830 (1973) (upholding state statute that barred public employees from, among other things, becoming “candidate[s] for nomination or election to any paid public office”).

In so doing, the Court has deferred to the reasoned judgment of the legislative body or government entity charged with making determinations about the intersection of public employment and elected office. See, e.g., U.S. Civil Serv. Comm’n v. Nat’l Ass’n of Letter Carriers, 413 U.S. 548, 555, 93 S.Ct. 2880, 37 L.Ed.2d 796 (1973) (“Congress and the President are responsible for an efficient public service. If, in their judgment, efficiency may be best obtained by prohibiting active participation by classified employees in politics ... we see no constitutional objection.”). For example, in Letter Carriers, the Supreme Court upheld a federal statute that prohibited civil service employees from “becoming ... partisan candidate[s] for, or campaigning for, an elective public office.” Id. at 556, 93 S.Ct. 2880. Recognizing the “right to participate in political activities is [not] absolute,” the Court upheld the restriction based upon four key principles: it (1) helped ensure the unbiased administration of the law, (2) avoided the appearance of impropriety, (3) preserved merit-based government employment and prevented corruption, and (4) ensured the independence of all government employees. Id. at 565-67, 93 S.Ct. 2880.

Later, in Clements v. Fashing, the Court upheld two provisions of the Texas Constitution of similar effect to that at issue under the federal statute in Letter Carriers. 457 U.S. 957, 971-73, 102 S.Ct. 2836, 73 L.Ed.2d 508 (1982). The first provision in controversy in Clements barred elected judicial officers from seeking election to the state’s legislature during his or her term. Id. at 960, 102 S.Ct. 2836. By operation of the second provision, any elected judicial officer who declared his or her candidacy for the legislature was automatically deemed to resign from the office then held. Id. The Court upheld these provisions under the same test announced in Letter Carriers. In particular, the Court concluded that the state’s interest in the principles articulated in Letter Carriers was “sufficient to warrant the de minimis interference with [any public employee’s] interest[ ] in candidacy.” Id. at 971-72, 102 S.Ct. 2836.

Any infringement of a public employee’s First Amendment rights caused by the provisions were “de minimis,” the Court reasoned, because “[t]hey limit neither political contributions nor expenditures. They do not preclude [candidates] from holding an office in a political party. [In addition, they allow candidates to] distribute campaign literature and ... make speeches on behalf of a candidate.” Id. at 972, 102 S.Ct. 2836. Thus, because Texas’ “resign-to-run” and “automatic resignation” provisions constrained any right to seek and hold elected office only in a circumscribed way they were “in reality no different than the provisions ... upheld in [Letter Carriers].” Id.

Following the Supreme Court’s lead, the courts of appeals have likewise accorded state and local governments wide latitude in regulating public employees’ exercise of any First Amendment right to pursue, much less hold, elected office. See, e.g., Claussen v. Pence, 826 F.3d 381, 387 (7th Cir. 2016) (upholding Indiana’s “resign-to-run” law, similar to that at issue in Clements); Phillips v. City of Dallas, 781 F.3d 772, 780-81 (5th Cir. 2015) (upholding a provision of the Dallas City Charter, which provided that any city employee who ran for partisan elected office within a county in which the city is located, or in “another county within the state, having contractual relations with the city,” was automatically deemed to have resigned from his office); Brazil-Breashears v. Bilandic, 53 F.3d 789, 791-92 (7th Cir. 1995) (upholding an Illinois Supreme Court policy that prohibited all judicial employees from “be-com[ing] a candidate for nomination, or election to, or accepting] appointment to any public office”); Fletcher v. Marino, 882 F.2d 605, 612-13 (2d Cir. 1989) (upholding a New York law prohibiting employees of local school boards from also serving on those school boards); Wachsman v. City of Dallas, 704 F.2d 160, 166-68 (5th Cir. 1983) (upholding a provision of the Dallas City Charter prohibiting city employees from participating in non-partisan political activities); Otten v. Schicker, 655 F.2d 142, 145 (8th Cir. 1981) (upholding a St. Louis Police Department rule prohibiting officers from becoming candidates for elected office). These courts have uniformly upheld reasonable restrictions on the rights of public employees to participate in elective politics, including restrictions on running for nonpartisan office.

Against that background, Loftus’ claim must fail. Although Loftus contends her termination was in violation of the First Amendment, the Supreme Court has made clear that public employers may permissibly bar their employees from participating.in a wide array of political activities, including running for elective office. If a public employee can be prohibited from running for office, it follows all the more strongly that she also can be barred from holding elective office while remaining a public employee. In large part, the constitutional questions raised by this case are resolved by Clements. If the resign-to-run and automatic resignation provisions of the Texas Constitution — which stripped certain public employees of their office upon declaring their candidacy for the state’s legislature — pass muster under the First Amendment, surely the termination of Lof-tus’ employment only after her election to the City Council survives First Amendment scrutiny.

Loftus attempts to differentiate her situation from the principles represented in Clements or Letter Carriers in two ways. Neither has merit. First, Loftus contends this case demands a different result because she ran for City Council in a municipality different from the one that employed her. On the circumstances of this case, however, we do not believe Loftus’ “different municipality” proposition carries any weight. See Phillips, 781 F.3d at 779 (upholding the Dallas resign to run law, which covered city employees seeking public office in any county that had a contractual relationship with the city). The principles illustrated in Letter Carriers and Clements on avoiding conflicts of interest, or even the appearance of impropriety, do not appear to require that either an actual or potential conflict of interest exist in fact in order for restrictions bn political activity of public employees to apply consonant with the First Amendment. But even if we were to assume such an actual or potential conflict were required, one exists in this case.

The record reflects multiple potential points of conflict that could face Loftus as a member of the City Council and an attorney in the Fairfax County Attorney’s Office. As the LEOs from the Standing Committee illustrate, it is not simply Loftus’ status as a public employee that creates a problem, but particularly her status as a lawyer for a public “law firm.” That role appears to create non-waivable conflicts of interest not simply limiting Loftus under her ethical duties as a lawyer, but imposing significant burdens on her public employer.

Moreover, Loftus is unable to point to any appellate authority to suggest that, all else being equal, her employment by a different municipality should be a dispositive factor in our analysis. In fact, she can muster only two district court cases to support her position, both of which are factually inapposite and of no precedential value. See Segars v. Fulton Cty., 644 F.Supp. 682 (N.D. Ga. 1986); Hickman v. City of Dallas, 475 F.Supp. 137 (N.D. Tex. 1979). Neither case involves an attorney representing one municipality while also running for office in another municipality to which her client potentially will be adverse in the future.

Second, Loftus argues her situation is different than that examined in Letter Carriers and Clements because the City Council is “non-partisan.” But as we have already noted, any partisan/non-partisan distinction is immaterial, particularly where a potential conflict of interest exists. The evils underlying the rule in Letter Carriers — “such human traits as personal ambition, greed, fear, and the like” — are made “no less harmful merely because they may be brought about by political pressures generated in a nonpartisan, rather than a partisan, political context.” Wachsman, 704 F.2d at 167-68. As the Fifth Circuit observed:

If Police Officer Smith is best suited for a promotion vacancy, but the promotion goes instead to Officer Jones, who is not qualified for the position, because Jones helped in the Mayor’s reelection campaign by soliciting campaign contributions from the businesses and residents on his beat while Smith, whose personal preference was the Mayor’s opponent, refused to do so, does it make any difference whether the campaign was partisan or nonpartisan? Will not the injuries to the efficiency of the police force and its morale, and to the rights of Officer Smith, be fully as grievous in the one case as in the other? Will not the confidence of the public be just as undermined? Have not the citizens on Officer Jones’ beat been just as imposed on by being solicited by the very governmental employee to whom, day in and day out, they must look for both effective police protection and for evenhanded, reasonable enforcement of the laws regulating their own conduct?

Id. at 167.

Thus, we find no merit to Loftus’ contention that she has a First Amendment right distinguishable from those considered in Letter Carriers and Clements.

2.

In the alternative, Loftus frames Bobzien’s termination of her employment as a violation of her First Amendment right to comment on matters of public concern, a right recognized by the Supreme Court in Pickering. Loftus thus contends we must balance her interest as a citizen in commenting on matters of public concern against the interest of the County, as her employer, in promoting “efficiency of the public services it performs.” Connick v. Myers, 461 U.S. 138, 142, 103 S.Ct. 1684, 75 L.Ed.2d 708 (1983). That balancing, however, is of no assistance to Loftus.

Many cases, including Letter Carriers, discuss Pickering balancing, and can be explained, at least in part, by that analysis. Letter Carriers, 413 U.S. at 564-66, 93 S.Ct. 2880; see also Phillips, 781 F.3d at 779-80 (concluding Letter Carriers supplants Pickering in cases involving a public employee’s right to seek and hold elected office). For example, the Letter Carriers Court expressly relied on the Pickering balancing test in upholding the federal law at issue, stating: “we think the balance [Congress] has so far struck is sustainable by the obviously important interests sought to be served by the limitations on partisan political activities now contained in the [statute].” Letter Carriers, 413 U.S. at 564, 93 S.Ct. 2880. Later, the Fifth Circuit reasoned that “the same interests that supported the federal law in Letter Carriers” certainly supported the constitutionality of a provision of the City of Dallas’ charter, which prohibited city employees from running for any elected office. Phillips, 781 F.3d at 779. In light of these cases, Loftus’ attempt to recast her claim under Pickering is dubious. But even if Letter Carriers does not already provide the relevant analysis for Pickering purposes, Loftus’ First Amendment claim fails in any event.

In our application of the Pickering balancing test, Bobzien “bears the burden of justifying [Loftus’] discharge on legitimate grounds.” Lawson v. Union Cty. Clerk of Ct., 828 F.3d 239, 252 (4th Cir. 2016). To justify his decision, Bobzien need not prove Loftus’ election to the City Council actually caused any inefficiencies in the workplace; rather, he need only show that an adverse effect was “reasonably to be apprehended,” which he did here given the potential for conflict between Fairfax City and Fairfax County. Smith v. Gilchrist, 749 F.3d 302, 309 (4th Cir. 2014). The Pickering balancing plainly favors Bobzien.

On one side of the equation is the extent to which Bobzien’s decision to terminate Loftus’ employment infringed on any assumed First Amendment right she might have to hold public office. We conclude any infringement was minimal, as Bobzien’s decision to terminate Loftus only after she was elected to a position on the City Council regulated her speech with a limited touch, if at all. Cf. Clements, 457 U.S. at 972, 102 S.Ct. 2836. Nowhere does Loftus plausibly allege that she was prevented from speaking on issues pertinent to her campaign or any other issues of public import. Nor does she allege she was prevented from conducting her campaign for City Council. Loftus’ complaint alleges no restraint on her First Amendment rights except the fact her employment was terminated “solely because she had been elected to the City Council.” J.A. 4.

On the other side of the equation is Bobzien’s interest, which also is Fairfax County’s interest, in the efficient operation of the Fairfax County Attorney’s Office. As a general matter, the County was not required to sit idly by as one of its employee lawyers took on additional “duties or allegiances to another locality or political constituency whose interests are or could be adverse” to its own. Appellees’ Response Br. 28. The possibility that Loftus’ duties as a member of the City Council would conflict with her duties as an assistant county attorney was more than mere speculation, given the history and reality of the relationship between the two municipalities. Because Loftus’ membership on the City Council potentially was inconsistent with her position as an assistant county attorney, Bobzien reasonably apprehended serious inefficiencies arising from that arrangement.

In particular, Bobzien believed that Lof-tus’ membership on the City Council and position as an assistant county attorney would create a far-reaching and intractable conflict of interest, not only for Loftus but also for the entire Fairfax County Attorney’s Office. Prior to terminating Loftus’ employment, Bobzien contacted the Standing Committee, which pointed him to LEOs 1718 and 1763. Both of those LEOs strongly suggested that Loftus’ continued employment as an assistant county attorney and her membership on the City Council would create an incurable conflict of interest, one which would prohibit any attorney in the Fairfax County Attorney’s Office from representing the County in matters, adverse or otherwise, with the City.

Loftus’ own correspondence with Ethics Counsel confirms the reasonableness of Bobzien’s position. As Ethics Counsel advised Loftus: “lawyers that serve on public bodies will create conflicts of interest if the law firm in which the public official practices also interacts with the public body on which one of its lawyers sits.” J.A. 57 (emphasis added). Loftus knew the Fairfax County Attorney’s Office interacted with the City Council in numerous matters, including contract negotiations. Moreover, Loftus also knew “[her] disclosure, recusal and non-participation in the matter brought by her law firm [would] not cure the conflict from a legal ethics standpoint” because “lawyers that hold public office are held to a stricter standard than non-lawyers holding public office.” J.A. 57. Under any applicable Pickering balancing, the intransient difficulties created by Loftus’ service as a lawyer-legislator balance heavily in favor of her public employer.

Accordingly, Loftus’ termination of employment did not violate the First Amendment, and, therefore, her § 1983 claim was properly dismissed by the district court.

B.

In addition to her First Amendment claim, Loftus contends Bobzien’s decision to terminate her employment also violated her rights secured by Virginia Code § 15.2-1512.2 and Fairfax County Ordinance § 3-1-19. We disagree.

1.

Loftus first argues section 15.2-1512.2 gives her an absolute right to hold public office as a public employee. That statute provides, “no locality shall prohibit an employee of the locality ... from participating in political activities while ... off duty, out of uniform and not on the premises of [her] employment with the locality.” Va. Code Ann. § 15.2-1512.2(B). The term “political activities”:

includes, but is not limited to, voting; registering to vote; soliciting votes or endorsements on behalf of a political candidate or political campaign; expressing opinions, privately or publicly, on political subjects and candidates; displaying a political picture, sign, sticker, badge, or button; participating in the activities of, or contributing financially to, a political party, candidate, or campaign or an organization that supports a political candidate or campaign; attending or participating in a political convention, caucus, rally, or other political gathering; initiating, circulating, or signing a political petition; engaging in fund-raising activities for any political party, candidate, or campaign; acting as a recorder, watcher, challenger, or similar officer at the polls on behalf of a political party, candidate, or campaign; or becoming a political candidate.

Id. § 15.2-1512.2(0. The statute includes no express private cause of action and does not mention the holding of elective office as a protected state law right.

Loftus’ state law claim fails for two reasons. First, under its plain terms, section 15.2-1512.2 does not create any private right of action. As a federal court, we lack the authority to create a right under a state statute where the state’s legislature has elected not to include that right. See A&E Supply Co. v. Nationwide Mut. Fire Ins. Co., 798 F.2d 669, 674 (4th Cir. 1986) (holding “federal courts should be reluctant to read private rights of action into state laws where state courts and state legislatures have not done so”). Absent “clear and specific evidence of legislative intent,” if a federal court creates a private right of action in a state law it “abrogates both the prerogatives of the political branches and the obvious authority of states to sculpt the content of state law.” Id. Thus, because the Virginia General Assembly has chosen not to provide a private cause of action in the statute, Lof-tus’ section 15.2-1512.2 claim must fail.

Even if we could imply a private right of action, however, Loftus’ argument — that section 15.2-1512.2 protects the right to hold office — is inconsistent with the text of the statute. Loftus admits section 15.2-1512.2 does not specifically create a right to hold office. Nevertheless, she posits that the statute’s is-not-limited-to language must include such a right because otherwise it “would render Virginia[’s] right to participate law and similar laws meaningless, as it would only cover a few weeks of political activity and not the result of the election.” Appellant’s Opening Br. 29.

Loftus’ argument fails as it asks us to expand the terms of the statute beyond what its text allows. When interpreting a statute, we must apply its plain meaning, “unless the terms are ambiguous or applying the plain language would lead to an absurd result.” JSR Mech., Inc. v. Aireco Supply, Inc., 291 Va. 377, 786 S.E.2d 144, 146 (2016). Where, as here, a statute includes both general words — “not limited to” — and specific words — voting, registering to vote, and the like — the meaning of the doubtful words in the statute “may be determined by reference to their association with related words and phrases.” Andrews v. Ring, 266 Va. 311, 585 S.E.2d 780, 784 (2003).

Through its expansive list of “political activities,” section 15.2-1512.2 protects a wide array of conduct by Virginia public employees. Upon closer inspection, however, each example falls into one of two categories: political organization or political campaign participation. Neither category is so broad as to include the acts of assuming elected office and governing, a fundamentally different function than campaigning for office. “If a municipality cannot prohibit its employees from holding political office, as Loftus claims, a county would be helpless to prevent even the most glaring conflicts of interest and to ensure public confidence in government.” Appel-lees’ Response Br. 48.

Therefore, the district court did not err in dismissing Loftus’ state law claim under section 15.2-1512.2.

2.

Loftus also contends Fairfax County Ordinance § 3-1-19 gives her a right similar to that for which she argues under section 15.2-1512.2. The ordinance protects the right of County employees to participate in “political activities,” a term that is defined by reference to section 15.2-1512.2. Fairfax Cty., Va., Code § 3-1-19(b). The ordinance does not establish a private cause of action. Rather, it adopts a right to a grievance proceeding before the Commission.

Loftus’ claim fails because the ordinance does not establish a private right of action. “When a statute creates a right and provides a remedy for the vindication of that right, then that remedy is exclusive unless the statute says otherwise.” Vansant & Gusler, Inc. v. Washington, 245 Va. 356, 429 S.E.2d 31, 33 (1993). Because the ordinance provides exclusively for a grievance procedure, we cannot infer a private right of action where the legislative body has declined to do so.

In any event, because the ordinance is substantively identical to section 15.2-1512.2, Loftus’ claim would also fail on the merits for the reasons discussed above regarding her statutory claim. Accordingly, the district court did not err in dismissing Loftus’ claim based on Fairfax County Ordinance § 3-1-19.

IV.

For all the foregoing reasons, the judgment of the district court is

AFFIRMED.

      . Because the district court decided the case on a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), we "assum[e] all well-pleaded, nonconclusory factual allegations in the complaint” and attached exhibits are true. Burnette v. Fahey, 687 F.3d 171, 180 (4th Cir. 2012); see also Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 322, 127 S.Ct. 2499, 168 L.Ed.2d 179 (2007) (discussing use of exhibits attached to a complaint). Numerous exhibits were attached, argued by the parties before the district court and on appeal. Accordingly, those exhibits are properly part of the record and relevant to the disposition of the issues before us.

      . For all intents and purposes, the Fairfax County Attorney’s Office is deemed a law firm similarly situated to a private law firm for purposes of the LEOs. Va. Rules of Prof'l Conductr. 1.10 cmt. 1a; r. 1.11 cmt. 2.

      . Both Bobzien and Long are defendants in this action. We focus our analysis only on Bobzien, however, as Loftus' claims against Long rise and fall along with her claims against Bobzien.

      . We have removed all internal alterations, citations, and quotations throughout, unless otherwise noted.

      . Bobzien contends Loftus' First Amendment claim fails because he is entitled to qualified immunity. "Qualified immunity protects [state actors] who commit constitutional violations but who, in light of clearly established law, could reasonably believe that their actions were lawful.” Henry v. Purnell, 652 F.3d 524, 531 (4th Cir. 2011). We need not reach Bobzien’s qualified immunity defense, however, because Loftus’ First Amendment claim fails on its merits.

      . Loftus maintains, as she must, this right exists as a constitutional entitlement wholly separate from any right she may possess under Virginia Code § 15.2-1512.2. See Baker v. McCollan, 443 U.S. 137, 146-47, 99 S.Ct. 2689, 61 L.Ed.2d 433 (1979) (holding a claim under § 1983 cannot be based on a violation of state law).

      . This Court also has upheld such restrictions on the rights of public employees to seek public office in an unpublished opinion. Jenkins v. Town of Bryson City, 946 F.2d 885 (4th Cir. 1991) (per curiam).

      . Loftus tries to distinguish Mitchell, Letter Carriers, and the like by pointing out that, in each of those cases, the public employee’s right to participate in politics was circumscribed by a valid statute or written policy. That argument does not merit much consideration. For one thing, Loftus points to no case to suggest a written policy is a constitutional requirement. Moreover, as noted above, Lof-tus was terminated pursuant to Fairfax County Personnel Regulation § 4.16, a written policy.

      . Loftus also argues Bobzien’s decision to terminate her employment violates the First Amendment because he did not employ the "least restrictive means.” In effect, Loftus argues that Bobzien should have found her additional or alternative employment. But she points to no constitutional basis for her argument, and we are aware of none.

      . Loftus points us to no Virginia authority to support her argument and we have found none.

      . Loftus tries to save her state law claim by recasting it as one for wrongful discharge in violation of public policy, a claim recognized by the Supreme Court of Virginia in Bowman v. State Bank of Keysville, 229 Va. 534, 331 S.E.2d 797 (1985). But Loftus failed to plead such a claim in her complaint. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (observing a complaint must, at a minimum, give the defendant “fair notice" of the claims against him).
      Even if Loftus had properly pleaded a Bowman claim, however, it would fail on the merits. A successful Bowman claim requires violation of a public policy established by statute. See Miller v. SEVAMP, Inc., 234 Va. 462, 362 S.E.2d 915, 918 (1987). As noted above, the only basis for Loftus’ state law claim is section 15.2-1512.2, which we have already determined gives her no right to proceed.