These passages present portions from the contemporary majority opinion authored by Judge Gregory Katsas, with Judge Neomi Rao joining, in the D.C. Circuit’s ruling in Anthropic PBC v. U.S. Department of War.
This case stems from the Department of War’s decision to remove Claude, Anthropic PBC’s artificial-intelligence product, from its supply chain pursuant to the Federal Acquisition Supply Chain Security Act of 2018. The Department acted after Anthropic declined to loosen contractual prohibitions on employing Claude for lethal autonomous warfare or domestic surveillance. Anthropic challenges the exclusion as arbitrary, not authorized by the governing statute, and unconstitutional.
We reject these challenges. The Department had ample support for its conclusion that continued integration of Claude into the Department’s information systems—whether by the Department itself or its contractors—posed a statutorily defined national-security risk. As Anthropic concedes, the company embeds restrictions within Claude that prevent the model from carrying out tasks the company wishes to prohibit. On more than one occasion, these restrictions have prevented Claude from completing tasks requested by government users. And a recent dispute concerned whether the contractual prohibitions barred Claude’s use in an ongoing overseas military operation, leaving the Department uncertain whether Claude would perform as intended.
Anthropic’s constitutional claims are also unpersuasive. Its due-process claim fails because the Department promptly informed the company of the exclusion and its supporting rationale, and then provided a fair opportunity to challenge the exclusion. And Anthropic’s First Amendment claim fails because the Department excluded Anthropic from its supply chain based on the company’s refusal to assent to a contract term the Department deemed essential, not on the company’s support for greater governmental regulation of AI technology….
This case confronts profoundly difficult questions about the appropriate military uses of an extraordinarily powerful new technology. The Secretary highlights the sobering possibility that overly constrained AI models could shut down unexpectedly, jeopardizing important military operations. Anthropic highlights the sobering possibility that unconstrained AI models could hallucinate inappropriate targets for lethal military force. Each scenario raises obvious national-security concerns. Yet in our Republic, it is up to the President and the Secretary of War to determine how best to balance those competing risks. In adjudicating here, the Secretary did not exceed any limits on his authority under the Supply Chain Security Act or the Constitution. Accordingly, we deny the petitions for review.
Judge Karen LeCraft Henderson dissented on statutory grounds:
Whether the Secretary of the Department of War (Secretary) lawfully invoked his statutory powers under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA) turns on whether Anthropic falls within the statute’s definition of a “supply chain risk.” “When Congress takes the trouble to define the terms it uses,” courts should apply them “with rigor.” And here, the Congress has taken great pains to define the type of “supply chain risk” that must exist before the Secretary invokes the sweeping powers FASCSA confers on him. Under the statute, he may exercise his authority to blacklist a procurement source from the Department’s supply chains “only after” the Department concludes the source poses a “significant” risk that it will:
sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.
My colleagues dispute that whether Anthropic qualifies under this definition depends entirely on the scope of section 4713(k)(6)’s residual clause: “or otherwise manipulate.” The Department and Anthropic proffer competing readings of that term. According to Anthropic, the residual clause uses “manipulate” to denote intentionally subversive acts conducted through deceptive means.
The Secretary contends, and the majority agrees, that the term covers much more. To “manipulate” a covered article, in their view, means to “move, arrange, operate, or control [it] by the hands or another body part or by mechanical means,” regardless of purpose or motive—for instance, how one might “manipulate” a doorknob by turning it or a gas pedal by pressing it. Both readings may be linguistically possible, but fundamental canons of construction require us to decide which better fits the surrounding text of section 4713(k)(6) when read as a whole. Because I believe the context clearly favors the narrower interpretation, I respectfully dissent….
I cannot accept that this is the scenario Congress envisioned when enacting FASCSA. The statute was enacted in response to requests from the U.S. intelligence community to address the threat of “[h]ostile nation state and other bad actors” infiltrating federal information and technology systems via supply chains. For years, national security agencies warned that firms “beholden to foreign governments” and other malicious actors were introducing compromised products into “[m]any of the technologies the Federal Government relie[d] on for vital, daily functions.” In their public reports, the agencies described numerous covert security breaches carried out by nefarious actors—and in terms that closely track section 4713(k)(6)’s central terms.
Such historical evidence showing how a statute’s terms were used before enactment sheds light on the intended sense of those words when Congress codifies them. That history supports Anthropic’s reading. It also rebuts the view that “manipulat[ion]” of a covered article extends to the kind of conduct that, under today’s decision, creates a supply chain risk—that is, a contractor’s forthright enforcement of restrictions on a covered article’s use disfavored by the government.
The majority’s response to the statutory argument is brief; here is a short excerpt:
Two final points. First, for the reasons discussed above, we reject Anthropic’s attempt to graft onto the statutory definition a universal requirement of acting surreptitiously, simply because two of the seven verbs in the string (sabotage and surveil) carry that connotation. Second, we reject Anthropic’s attempt to draw from the legislative history a focus on “foreign companies working at the behest of foreign states.” Whatever paradigmatic examples individual members of Congress may have had in mind, the statutory definition is not limited to “adversar[ies]” and instead covers “any person,” which cannot refer only to foreign entities….
In sum, we conclude that the Secretary’s concern about Anthropic disabling Claude from performing lawful actions requested by the Department qualifies as a “supply chain risk” within the meaning of section 4713.
There is considerably more, on both the statutory and constitutional questions, in the full opinions. I expect to discuss additional aspects later, but for now I wanted to share what struck me as the most significant excerpts.
On the government’s side, counsel included Sharon Swingle, Brett A. Shumate, Eric D. McArthur, Sean R. Janda, and Brian J. Springer.
