Oral argument — Anthropic PBC v. United States Department of War

Case number 26-1049, Anthropic PBC Petitioner v. United States Department of War in Peterby, TX, in its official capacity as Secretary of War. Mr. Dunbar for the petitioner, Ms. Plingo for the respondent. Good morning, everyone. Judge Henderson is with us remotely. Mr. Dunbar. Thank you, Your Honor. May it please the Court, Kelly Dunbar for Anthropic. The Secretary's supply chain risk designation defied congressionally mandated procedures, exceeded statutory limits, and violated the Constitution. For the first time ever, the Secretary turned a powerful national security authority against an American company, and he did so to gain leverage in a contract dispute. But the record now establishes that the Secretary's own risk analysis was built on a mistake, that Anthropic has the technical capability to manipulate CLAWD after deployment in classified environments. Our declarations establish that that's factually incorrect, and the Secretary's brief does not defend it. He now says his true concern is the ability to train CLAWD before deployment. There are many problems with that. Before you drill into this, sorry to start with a curveball, but you have a pending motion for reconsideration, and the government promised action on that by a day or two ago. Did you hear anything on that? We have not heard anything on that, Your Honor. Do you think that the pendency of the reconsideration motion creates any jurisdictional or reviewability problems for us under – we have something called an incurably premature doctrine? I don't think it does, Your Honor, and probably the easiest answer is I think that argument is forfeited. The finality doctrine under the APA on which the incurable prematurity is a doctrine that can be waived, it doesn't speak to this court's subject matter jurisdiction. This court's decisions in cases like Salazar and Trudeau versus FTC says the government can waive that objection. I think there's also not just a forfeiture answer, Your Honor, which is that the text of 1327 is distinct from the APA's finality provision in that it triggers the time for us to seek judicial review from receiving notice of the covered peturement action. It doesn't speak of finality. So to the extent that doctrine is a gloss on the APA's finality requirement, we don't think it applies here in any event. We think that argument is forfeited. Can I ask you another jurisdiction question? So 1327 strips this court of jurisdiction for most decisions under 4713, but it does allow us to review covered procurement actions. So what is the covered procurement action that Entropic wants us to review here? I think the simplest answer is there are two. The first is that the effect of the Secretary's supply chain risk designation and his decision to invoke all covered procurement sanctions authorized by the statute is that we are immediately and permanently disbarred from government contracting. That's under 4713K4C. We are not a responsible contractor, and therefore, with respect to existing and future contracts, we're simply ineligible. That's an immediate legally operative consequence of the designation. So do you read the notice as also ordering the taking of covered procurement actions? Because the way I read 1327, Entropic cannot challenge the designation standing alone. There have to also be covered procurement actions. And one way to possibly read the notice is to say these are just the findings they have to make as part of a designation, i.e., like the scope is all covered procurement actions. The notice doesn't necessarily say we are taking all covered procurement actions. So, or do you read the notice to basically say we are, like, there is a blanket exclusion of Entropic, and that blanket exclusion or disbarment is the covered procurement action that's being challenged? I just think this is really important, especially since this is the first time the statute is being interpreted by a court to be very clear about what we're reviewing and, you know, how it's reviewable. I'm interested, John, and I appreciate the questions. You know, as the government has conceded, I think, in its red brief, the Secretary, we do read the March 3rd written designation itself as well as the notice to immediately take all covered procurement actions authorized by the statute. One of those covered procurement actions, and I think procurement action is a little bit of a strange-sounding term here. To me, it's more like a sanction. What are the sanctions the Secretary has authorized? One sanction is our immediate and permanent disbarment from government contracting. A second sanction is our exclusion from all subcontracting possibilities under covered department contracts. And, again, we read the underlying agency materials to say the Secretary has immediately implemented those, and I think the Secretary shares that reading. I do agree with you, Your Honor. There would be a different question, I suppose, if the Secretary made a designation finding in the abstract and said, I'm going to later return to figuring out what the scope of covered procurement actions I'm ordering is. We don't think that circumstance is presented here. And, frankly, I think I'm not actually sure the statute would allow that. This B4713B seems to contemplate that in the written determination, the Secretary will make the class of covered procurement actions determination. But, in any event, that question is not presented here because we think these materials clearly do immediately implement all covered procurement actions authorized by the statute. Do you think the March 3rd determination is itself the reviewable order? I think that's probably the best. I think that's correct, Your Honor. You have a fallback that there's this March 6th action through which the determination was implemented. That's correct, Your Honor. There is a March 6th memorandum from the Department of War's Chief Information Officer that purports to implement the Section 4713 designation. We don't think that is the – I think that is evidence that the Secretary is immediately implementing and has immediately taken the covered procurement actions. Do you want that as a fallback if Judge Rouse's objection persuades us on March 3rd, on the March 3rd order? I certainly wouldn't resist that, Your Honor. I do think this is obviously just unfolded in a bit of a procedurally irregular manner. There are several agency documents. We read them together to designate us as a supply chain risk under 4713B and order all covered sanctions that the statute authorizes. And we read those to be in effect immediately. I think I should clarify what I'm saying because I do think it's important. So, like, a covered procurement action doesn't necessarily have to be a discrete action like we are taking you out of a particular contract. A covered procurement action can be kind of a blanket exclusion or disbarment. Correct. And I think 4713 seems to contemplate that the government may take blanket exclusions or disbarments. It could be a class determination. It could be a class determination, which makes sense because if there's a supply chain risk, then you may – the government might at least want to take a supply chain risk after – out of a large class of contracts or – Correct. And that's – we share that understanding, Your Honor. And that's, again, we read the written – the March 3rd written determination. I think the section, the sub-bullet in the Secretary's memo says class of covered procurement actions and then defines all covered procurement actions that are authorized by the statute. So, we do think – I appreciate the court's concerns, obviously, about subject matter jurisdiction. We do think those are present here. If I could, you know, turn back to what – you know, again, I think there's a fundamental pivot in the government's defense of the designation in its red brief, and that's the switch from the concern that Anthropic has the technical capability to manipulate CLAWD after deployment to a pre-deployment model manipulation theory. And I think that has three – This is your substantive arbitrariness point. I think it has three sort of direct implications, Your Honor. The first is that given Undersecretary Michael's insistence in the underlying litigation materials and record materials that the risk analysis here was cumulative, that not one factor standing alone may have justified the designation or the scope of the designation, I think that in light of that concession – and it's not so much a concession. It's just an acknowledgment of how the Secretary was thinking about the problem. In light of this court's cumulative rationale principles, the national fuel case we cite in our reply brief, I think this court should hold the designation unlawful and remand for the Secretary to do whatever he might do with the correct understanding of the facts. I get that. I'm just – I'm trying to tease out. You made a threshold procedural argument just about invocation of the truncated procedures. Absolutely, Your Honor. Is that still live? I mean, the effect of that was to not give you prior notice and 30 days in which to make whatever submission you want to make opposing the designation. And you're right. There's been this weird process as the case has unfolded. But as we sit here today, you had notice and 30 days to tender whatever you want to tender, and we have that before us. And so why don't we just evaluate the substantive arbitrariness and lawfulness of the agency action in light of your supplemental submission? It's just the procedural error has been overtaken by offense is what I'm suggesting. I think there are three reasons, Your Honor. The first is that we – with respect, I don't think we have received the process that's due under the statute, which includes notice of the joint recommendation and the factual basis of a joint recommendation. We got that on March 19. But we don't know what the Secretary's new explanation is in light of the record evidence that we've submitted, including the fact that a critical predicate of the prior risk analysis was unsupported. We don't know how he might attempt to justify a new designation. That might weaken the rationale when we review it for arbitrariness. I think that's true. I'm not sure it's a freestanding procedural error, though. I mean, if it still holds up in light of your best shot after 30 days to compile whatever you can compile, what are we going to do? Sort of remand for him to just repeat the same points, and then we're here six months from now reviewing the lawfulness and arbitrariness? I think we're just making a simpler point, Your Honor, which is that the statute entitles us to see a joint recommendation that says, I'm going to designate you or a plan to designate you on the following factual basis. We really haven't had the opportunity to see that yet in light of what might be a significantly reconfigured risk analysis. But the second point I'd like to make, Your Honor— Is this petition incurably premature, then, because we're waiting to see what happens on reconsideration? I don't think so, Your Honor, for some of the reasons I discussed with Judge Katsas at the start. I don't think there's a typical APA finality requirement here. We don't know when or what form a reconsideration decision might take. It could be a one-sentence explanation. It could be an attempt to implement a new, revised designation. We just don't know what the Secretary has in mind. And so I think until that happens, we have every right that Congress gave us in 1327 to ask this court to enforce compliance with the procedure. But if I could return to Judge Katsas, your good questions about harmlessness, I think there are two other points I'd make. The first is that this statute, unlike the APA and unlike many other statutes, doesn't contain, by our reading, a harmless error requirement. The idea that no harm, no foul, I think, is just a version of the established APA prejudice rule. Pretty strong background. Well, Your Honor, in the NRC and allied health cases, we cite in our bravery, this court was actually reluctant to carry over the APA's prejudicial error rule to the Medicare statute, for example, just because it happens to have a notice and comment procedure as well. The NRC decision similarly made the point that the harmless error rule isn't a free-floating sort of common law principle. It's actually one of statute. And Congress, again, gave us a right under 1327b2e to have a designation set aside that's not in accord with the required procedures. The final point, though, I'd make on the harmlessness question, Your Honor, is a pragmatic one. You know, this court's decision in national tour brokers, which we cite in our opening brief, makes the insight that when you have a decision maker that has reached a final decision and then submits the opportunity after the fact for comment or evidence, there is a bureaucratic and decisional logic that it becomes harder to achieve a reversal of a final decision once it's made. In other words, I do think there's a… Fair point, but it's sort of the same thing if we remand. I don't think so, Your Honor. I think what we would ask on a remand is that you hold this designation procedurally and substantive unlawful. If the secretary wants to make… Just focus on the procedure. If you win on that narrow ground and it goes back… And I think the secretary would start over on a fresh slate and make a decision. Is it worth imposing a supply chain risk designation knowing what I know now about the factual predicate? Our only point is I think there is a fundamental difference between asking Secretary Hegseth to rescind an already existing designation based on new evidence and a question about whether moving forward the secretary would reach the same decision if he knew that a critical part of his prior risk analysis was wrong. That's three out of three, so you can go on to… No, look, I… Secretary DeLauro, you want to do arbitrariness first. Well, I do want to—I appreciate the points about procedure. We do think, obviously, that the secretary really made no effort here to comply with the statute's procedural requirements. The secretary makes an argument that that determination is just not judicially reviewable at all. We think that's incorrect as a textual matter, a structural matter, and a constitutional matter. I'm happy to address those questions if those are in the court's mind. But if the court was most concerned with harmless error requirements, I think I've given my explanations on why that shouldn't be an excuse for his procedural violations. Give me a quick answer on reviewability. This has a little bit—this has some similarity with Webster v. Doe. Maybe the terms are less open-ended, and maybe you don't have 701A2. But you do have this—the point of similarity is that the trigger is not some fact in the world. The trigger is whether the agency had made the determination. So we'll review that. Sure, he made the determination. We're done. Your Honor, as I said, I think there are three reasons, and I'll try and be quick on it. Textually, I think every textual indication in Section 1327 and 4713 is that Congress intended this urgency determination to be judicially reviewable. That is, I think, a defining difference from— Do you think the determination is reviewable, or the covered procurement actions taken pursuant to the determination are reviewable? I take your point, Your Honor. We are in challenging the covered sanctions that are immediately in effect. We are allowed to say, you didn't follow your statutory procedures. He will say, I had an urgent national interest to do so. Our point is that Congress may, in giving this court—charging this court, frankly, with ensuring that the secretary complies with the statute's procedures, that necessarily requires the court to apply some level of judicial review to the urgency determination. And I think that is a defining difference from the scheme in Webster v. Doe. Second, I think there's a structural point. If the secretary could just bypass the statute's procedural safeguards just based on his say-so of an urgency determination, and there was no back-end judicial review at all, I think that would render this entire statutory scheme ineffective in a way that we wouldn't ordinarily presume Congress intended. But third, there's a constitutional backstop to this. This court's foreign terrorist organization precedents and roles explain that where the government wants to come in and defend after-the-fact process as sufficient, even in the national security context, it needs to make a particular showing to this court that justifies that. So if you were to read this statute as foreclosing that judicial review, I think that would raise a serious constitutional question. And when I read FASCA, it seems as though Congress incorporated many of the insights and holdings from Rawls and the National Council case. And it creates a process where the government has to say there's an urgent national security interest, and the secretary has done that here. Why doesn't that satisfy the reasoning of Rawls? Well, because I think Rawls – what Rawls spoke about – I mean, there was a particularized determination that the ordinary procedures needed to be bypassed because there was an urgent national security interest. And also the statute is interesting in saying urgent. It doesn't say emergency national security interest. I mean, it's quite broad. It has to be urgent. It has to be an interest. Well, let me take those in turn, Your Honor. It's not that stringent in some ways. The first point I'd like to make is that maybe the National Council of Resistance of Iran decision is a better answer to Judge Katz's question than Rawls. What this court said in that case is that it is the government's burden to show a particularized need to dispense with pre-deprivation process, and that it would need to make an adequate showing to the court that there was an exigency or a foreign policy or national security reason that justified that. So that is the sort of backstop for our constitutional point that I don't think one would naturally read 1327 to mean the urgency determination is effectively unreviewable. Sorry, Your Honor. If it were unreviewable, I agree with your last point. We would have to do some work under the due process rubric to figure out if there is sufficient reason for post-deprivation process. Would that be the same inquiry, roughly, as the statutory question of urgency if it were reviewable, roughly? In a nutshell. I think that's what we're asking for, essentially, is to apply. I mean, to Judge Rao, your point, I mean, urgency is not necessarily a precisely defined term. I think that was meant to track perhaps even the circuit's precedent that says, look, the constitutional default is noticed in an opportunity to be heard before a designation. In some circumstances, there can be post-deprivation process, but the government needs to make a particularized showing. And that particularized showing, I think, importantly, and this helps answer your question about urgency, I think needs to be something other than just the general interest that underlies the agency action in the first place. This is a structural insight we borrow from some of, you know, this circuit's APA good cause cases, which is, and I understand the government's argument that those are inept here. But I think the structural reasoning is similar, where you have an exception for exigent circumstances, and you have default mandatory procedures. If we allowed agencies to skip over those mandatory procedures simply by pointing out that they have some public interest basis for acting, that would, you know, threaten to elevate the statutory exception into the default rule. And so I do think it is important on the urgency determination. We are not suggesting this court should put on a national security hat and, you know, flyspeck every national security determination. I think we're asking for something more modest, which is the urgency requirement at least would allow you to measure the secretary's claimed exigency against his own actions. And again, as we explained in our briefs, I think there is a fundamental logical incompatibility between saying Anthropic could not have 30 days of pre-designation process while at the same time ordering a six-month transition away from Claude in military systems. We aren't asking—we aren't attempting to second-guess the secretary's operational judgment that perhaps during, you know, Operation Epic Fury, it was necessary to keep Claude in classified military systems. We're simply making a more modest point that having made that decision, there's no reason the secretary couldn't have afforded us the process that was due under the statute and potentially the due process clause as well. I'll make one more point about that as well, and this is a textual point. Section 4713b2a says that the secretary is authorized to provide notice to us not only of the joint recommendation from the underlying agency officials, but also notice that a joint recommendation is being considered. So if he had some special concern with actually waiting for the joint recommendation because there was such an exigency, he needed to move quickly. He, at a minimum, could have notified Anthropic that a joint recommendation was under consideration, provide a modicum of the factual basis for that, and given us the opportunity to respond. My apologies. I haven't been looking at the timer and recognizing well over— You're on our channel. Understood, Your Honor. Mr. Dunbar, can you hear me? I can, Judge Henderson. Great. I want to go back to the definition in 4713k6. For the life of me, I do not see, under the definition, any evidence of maliciousness, despite the best efforts of Mr. Michaels, who in his memo refers to you as having mal-intent, a bad motive, cannot be trusted. I see no evidence of the fact that the words sabotage, maliciously manipulate, and so forth, require a bad actor. I see no evidence of that. I don't see that the Department has in any way supported its determination that there is a supply chain risk with Anthropic, much less a significant supply chain risk. Is there some evidence that I haven't found that you're a bad actor? No, Judge Henderson. To the contrary. I think all available record evidence suggests to the contrary, and I'm happy to talk about that evidence. But I also think the Secretary's own actions, I would respectfully submit Judge Henderson suggests he doesn't believe it either, including the fact that— I agree, Your Honor. And on the statutory point, I don't want to fight this line of questioning too much. I would make the point that there are broader and narrower ways to read the statute, but I think your instinct is exactly right, which is that even if the statute could be read broadly to reach unintentional, reckless behavior that created a sabotage risk, that's not what the Secretary alleges here. The Secretary alleges, as you say, that we are a hostile party with adversarial intent, that we have an adversarial posture, and that we—fundamentally, the Secretary's new theory is that we would design Claude in secret so as to avoid the department's testing in a way that would have the effect of or reasonably have the effect of disrupting later U.S. military operations. And I think that theory, Judge Henderson, is unsupported factually and legally for many reasons. It's really an effort, I think, to force what is fundamentally a contract dispute and perhaps a vehemently argued and reasonable minds will disagree contract dispute into the square—the round, you know, the square hole into the round peg of this particular—I think I got that backwards—of this particular statutory scheme. That statute itself says that he is to consider less intrusive means. Absolutely, Your Honor. And, you know, as I— He just reached a very conclusory decision that they're not workable or not reasonable. I don't think that's enough since I think he has to tell Congress specifically why less intrusive means won't work, doesn't he? That's correct, Your Honor. And all we really have is conclusory assertions. But I think particularly if the risk here is not this headline-grabbing theory that was the Secretary's original theory that Anthropocene could somehow reach into ongoing military operations in Iran and pull the plug, you know, while our jets are about to carry out a strike, once you're stripped of that theory because it's factually incorrect, you're left with the idea that, again, in the future, we might encode limitations into Claude that the Secretary can't detect. The less intrusive solution to that is simply to stop procuring new models of Claude if the Secretary can't get comfortable that his testing regime is adequate to address that risk. But the jumping to a never-before-used blacklisting authority, we agree Judge Henderson, is fundamental overreach. Mr. Dunbar, I take the Secretary to be making more general points than the ones that you've identified. So even if the backdoor, even assuming the backdoor is factually incorrect, which I don't see the government disputing, I mean, when you read through the documents, the government is relying on the nature of AI models, which are inherently opaque and probabilistic, and the fact that there could be things embedded even in current models of Claude that the government is using that may operate in ways that, you know, create certain risks that the government cannot detect. I mean, I think all of that is reflected in the government's reasoning about why this is supply chain risk, right? I mean, if it's about risk and they say, well, based on what we know, we can't trust that the model may not have something embedded within it that is going to create a problem for military capabilities. So why is that not sufficient? Or on what basis could we, you know, sitting here in the D.C. Circuit, second-guess that judgment? I think perhaps the easiest is where Judge Henderson ended, which is that there are less intrusive measures to address that. I mean, if the secretary cannot get himself satisfied that any defense product he's purchasing will meet standards and specifications of operability during conflict, the secretary probably shouldn't procure it. We would hope, you know, Anthropic would hope that we could work with the department to address any of those concerns. And I'll tie this back to the process point. This idea of technical manipulation was never something that was raised with Anthropic prior to the supply chain designation. If the secretary had raised this concern, Anthropic could have looked to work for ways to work with the department to develop more transparent model training. I don't see Anthropic to question that the model may work in ways that maybe Anthropic and the government cannot necessarily be fully aware of. We don't dispute that, Your Honor. That is certainly intrinsic to all AI technology. And that seems to be a big part of the government's reasoning. I think I'd go back to the point, Your Honor, that if that is the basis for the government's reasoning, which is that you have opaque models, and we don't think that Anthropic's models we can trust to live up to the job, that is an ordinary operational and procurement decision that the department is well-equipped to make without jumping to the highly public blacklisting of an American company as a national security threat. So take the government's rationale in its best possible light. Forget about all the crazy rhetoric about, you know, crazy company and stuff. And forget about the concern about the kill switch in real time. But still have this concern, right? The model is unpredictable. There have been instances where the model is not allowing the government to do things that it should be allowing to do. There's been at least one instance, potentially very sensitive, where the model is allowing the government to do something that Anthropic might think it should not be allowed to do. And it's undisputed. You not only have the ability to build limits into the model, but by your own admission, and this is probably an admirable thing, you embrace that. You say, of course, we're going to build limits into the model. We're not going to sell something that can produce child pornography or nuclear weapons. Like, that's great. But it causes this concern for the government that it might not work in ways that the government wants it to work. Your Honor, I don't want to be a broken record on it. I do think the simplest answer to all of that. I'd be happy to unpack each of the sort of steps you gave in the analysis as well, because I think there are things I would have to say. But the bottom line is that in that circumstance, the Secretary shouldn't purchase Claude. If everything I said is the government's rationale and just stipulate for the sake of argument, it's not an arbitrary one, then what follows from that is they should not have Claude, they should not use Claude directly as a contractor, and they shouldn't have their own contractors encoding Claude's stuff in work for the government. And that is what this scheme, that is what this designation accomplishes. Your Honor, I think the means matter here. Even if you thought that the Secretary, through ordinary procurement tools, could get to the same result, which is we essentially don't want Claude embedded in a covered system, the question, and certainly this is the less intrusive measures requirement that Congress wrote into the statute that Judge Henderson referenced, the question is, does the Secretary have other non-blacklisting, non-Section 4713 designation authorities to achieve that result? And Your Honor's recitation of events sounds to me like a scenario where a government purchaser decides a particular product or service isn't the right fit for that agency's mission. We would submit that the answer to that, again, is fairly straightforward. Is it less restrictive because the more conventional procurement actions lack stigma, or is it less restrictive because, I don't know, you can still use Claude to manage the inventory for the mess hall or something? I think those are part of it. I think of it as sort of four quick reasons, and I'll be quick about it. The first is that this is a permanent legal disbarment from all contracting, going back to my discussion with Judge Rao early. That is something, I think, materially different to the company from sort of case-by-case procurement decisions that are more, I think, ephemeral in nature and that could change. Second, the 4713 designation, 4713 is a part of a broader statute that was meant to be a whole-of-government approach to supply chain risk. So I think using the 4713 tool, I think, creates a unique risk of broader government-wide exclusions. In fact, Undersecretary Michael's litigation declaration in Appendix 219 explains the department has already begun information sharing under that statutory scheme. The third point, and I don't want to undersell it, is the reputational stigma. There's a through line in this Court's decisions in the cases we cite, from the Fortec decision to Old Dominion to National Council, that recognizes, I think, what I would hope be a common-sense point, that when your government brandishes you as a national security threat, as a subversive, as the equivalent of a saboteur, and does so by embodying that determination in a legal judgment that has the force of law, there is a unique reputational consequence to that. And that deeply matters to ANTHROPIC, not just as an intrinsic matter, given that ANTHROPIC is founded on the belief of promoting beneficial AI uses for humanity, which includes defending the United States and its democratic allies. The final point is that the supply chain designation, and particularly the unusual way it has unfolded in this case, does risk broader, cascading commercial implications that a simple, ordinary procurement decision, I would submit, Judge Katz's, would not. And I think the record at this stage certainly substantiated that the government's actions here have created significant questions about when and under what circumstances Some of the amici make a concerning argument about the difficulty of untangling, and how's the contractor supposed to know whether CLAWD was or wasn't embedded in its code? That's correct, John. I think I get that. And there's, you know, contractors. I'm sorry. How would it be different? That concern would be equally present if, through conventional procurement, without this stigma, the government just barred contractors from using CLAWD in its subcontracts. I think it would depend on what procurement tool the Secretary chose next. I would spot you there could be ways in which some of the reputational damage could be similar. But I think there are far more prosaic operational ways to simply say, if this model doesn't satisfy our needs, we're not purchasing it. I think another approach is set forth. The Secretary of War himself issued a memorandum on January 9th that the government cites in its brief, and this is at Appendix 206, that directs within 180 days, as I read it, all department contracting officers shouldn't be awarding contracts to AI models that don't permit the models to be used for all lawful uses. I think that memorandum itself, again, tying back to Judge Henderson's point, is an obvious less intrusive measure staring us right in the face because the Secretary has said it, which is an instruction to his contracting officers. If you don't like the contract language and a contractor won't agree to our preferred terms, don't sign the contract. Mr. Dunbar, the remedy that we can give under 1327 is simply to say that the covered procurement actions are unlawful. How does that address Anthropic's, you know, harms from, you know, stigmatic harms? I think it would in the following sense, Your Honor. Because we can't order them to restore all the contracts. I don't think that we don't have that remedy available to us, and I don't think Anthropic suggests we do. No, two points on that, Your Honor. The first is that I think the whole, you're right, the only remedy that Congress applied in 1327 is to hold unlawful the covered procurement actions. On the way to deciding whether these covered procurement actions are unlawful, we would ask the court to decide whether the 4713B determination that underlies those covered procurement actions was substantively and procedurally lawful. So, we think a decision from this court saying that the secretary didn't follow the right procedures, or that the secretary's supply chain risk designation doesn't add up under whatever level of deferential review this court would apply, would go a long way towards redressing the reputational consequences that I just discussed. The second is, I do want to make clear, and we explained this in our opening brief, that we agree with you that the remedy Anthropic is seeking here is not to force the department to contract with Anthropic. When Anthropic made the decision to stand on these usage restrictions, which it viewed as a principled stance essential to its mission, it understood the Department of War might very well disagree. It understood that might mean the Department of War would say, we can't contract with you. Anthropic was prepared to accept that as a consequence of its own choice, and was prepared to work with the department to transition to other vendors. So, the question here isn't that we're trying to force contracts onto the department that the department doesn't want. We're simply attempting to make sure that the department is not misusing, in our view, a narrow supply chain risk designation to gain leverage in a contract dispute, to retaliate against Anthropic for its perceived disagreement with the department. That's fundamentally what this case is about in Anthropic's view. It gave you what I thought was the best spin on the government's explanation, and you said you had points before getting the least restrictive alternative. So, I'll give you a chance to. I do want to say, I have a lot, sort of, to Judge Henderson's points. I think there are lots of things that could be said about the more, what I would call outlandish versions of the allegations that we're a hospital. You can encode elements which are hard to test and unpredictable in real time, and there's been friction. You put in evidence, you put in a newspaper article saying that this hit the fan in the middle of the Maduro raid. I don't know if that's true or not, but that's pretty serious concern for the government if something like that is happening. Your Honor, I think that dispute, I'll say a point about Maduro and then a point about the two other examples of encoded limitations. You know, on the Maduro raid, the reality is this was, as I understand it, and as the Secretary has explained it, this was an after the fact, after post-military deployment question that arose about how. Yeah, yeah, yeah. This was, but I think this speaks to the fact that there is something fundamentally dissonant, I think, about the fact that a dispute, an open public dispute over contractual restrictions, between the Department and Thropic has become a basis for suggesting we would secretly encode technical limitations in the model for which there's no evidence. And even the government's telling of the Maduro incident doesn't suggest we were looking to encode ahead of time technical limitations. Most charitably even to the government's telling that example suggests a single and Thropic executive asked a question about how Claude was used in a particular deployment. We think it was to make sure Claude was functioning correctly. We understand this court's not going to be in a position to resolve that factual dispute. But I think the more fundamental answer to that, Judge Katsas, is as our uncontested declarations established, when Anthropic's CEO met with Secretary Hegseth in a person-to-person meeting in Washington, D.C., the Secretary raised that incident, and Anthropic's CEO stated in no unequivocal terms that Anthropic has no interest in questioning the use of, the Department's use of Claude. It has no interest in inserting itself into the operational decision chain, and it proposed, specifically proposed contract language to address that concern, to address that concern. I wanted to also say a bit about the two model encoding examples that the government cites. Because, frankly, I was really surprised to see those referenced like four times, I think, in the government's brief. Because it's really hard for me to understand how those examples prove anything else than the fact that Anthropic is committed to federal partnerships and committed to the public interest. The first example, and I think the government admits the facts here, so this isn't a factual dispute, is that when Claude was first deployed for military and intelligence community uses, it was the commercial model. Anthropic had rightly trained its commercial model not to read or analyze classified materials, which is a very sensible limitation, I think, for a commercial artificial intelligence model to protect the nation's secrets. As soon as that concern was raised, Anthropic worked over a period, a substantial period of time, with its national security partners in the federal government to develop Claude Gov. This is all set forth in uncontested declarations in the case that would enable Claude to be used for the national security uses that the Department intends. So the idea that that is evidence that helps the government's case, I've not really ever understood. The CDC example that the government cites is similar in pattern. Anthropic was unaware that the CDC was using a general commercial model of Claude, which was refusing certain prompts, and we don't know what the specific prompts were. I suspect they had to do with bioweapons development, because Anthropic takes significant steps to ensure that its commercial models cannot be used to develop biological weapons. As soon as that concern was raised with Anthropic, Anthropic worked closely with the CDC and the prime contractor that was involved to address those concerns. So I think those examples, to Judge Rao's point, do suggest that AI technology is new and going to prevent new challenges for the private-public partnership. But the examples, I think, demonstrate a fundamental commitment of Anthropic to helping advance the federal policy. No doubt the examples tend to show a good corporate citizen. I'll spot you that. But they also show hard-to-manage disputes over hard-to-manage questions about getting the model to do everything it should and not do things it shouldn't, right? I 100% agree with that, Your Honor. Taking a step back, right, you don't dispute that Anthropic can and does encode into the model use restrictions that the company, quite properly, feels very strongly about. I don't, but let me… When you sell to a commercial user, the model incorporates restrictions on everything from child pornography to inciting violence. That's correct, Your Honor. Denying elections and spreading misinformation. Yeah, I'm not sure on the misinformation piece, actually. It was in the use policy in the record. Oh, got it, got it. Well, that's why I did want to differentiate. The answer to your question generally is yes, and I 100% agree that that is… And you have contractual restrictions, and you develop your model not to do things that you don't want it to do. There are two layers besides contract restrictions that are issued, and I just want to draw the distinction between them. It may not matter to answer Your Honor's questions, but to be accurate, there is… And this is set forth in the Ramaswamy Declaration in paragraph 9. There are essentially three levels of safeguards. There is things Anthropic can do with the model training layer. I think I'm talking about the first. I'm not sure I understood one versus two. Well, I did want to… Focus on one versus three, but go ahead. I think one versus two does matter in this context very briefly, and it may not matter to the fundamental thrust of your question. At the model training stage, Anthropic, through training of CLAW in a variety of techniques, does develop guardrails is the technical term that you use through model training. We're exceptionally transparent about that. That's sort of the core of Anthropic's mission is to be transparent. We wrote a constitution. We wrote the constitution, which I understand becomes part of the reason the government criticizes, but other AI developers haven't done similar things, and that's Anthropic views that it's critical so that people, even in the commercial market, can know how their models are being trained. There is a second layer, which is the safeguard layer. The safeguard layer works for commercial models. It's essentially—I'm not an expert here, but you think of it as sort of technical controls that run on top of the model. Once a model is trained, it's sort of static and set. Its guardrails don't change. There's a safety layer on top of CLAW in the commercial market where Anthropic can use classifiers and probes to detect suicide requests, trial pornography, things like that. That's the real-time kill switch. Very similar. And that second layer basically has no application in the classified military deployment, but we can train. You build restrictions into the model about things you care deeply about. That's correct. And one thing that you care very deeply about in this record is lethal autonomous warfare for moral reasons and for safety reasons. Correct. So why wouldn't you build those use restrictions into a model? I think fundamentally the first answer to that and probably the answer for now is that there's not a capability to do that. A model would need to know whether there is a human— You do exactly what you do with your constitution. You give Anthropic— Oh, no, I— You train the model, you know, not to drop the bomb unless a human intervenes and says that's okay. Your Honor, I'm not aware if there is a technical way for a model to know whether there is a human in the decision-making loop, is my point. But I don't want to resist too hard the idea that, as we've said and we've been open about, Anthropic's founding mission is AI safety. It has not—there's no record evidence that we have attempted to encode the two narrow use restrictions that are issued here into CLAWD. Whether that could ever happen in the future, you know, I'm not sure there's the technical capability to do it now, but I don't want to—you're right. I don't want to rule that out. I didn't see a direct answer to that question one way or the other. But I did see a history where, you know, this starts with earlier generation of Anthropic products with more use restrictions embedded in the model. And then you're negotiating with the government about which of those to loosen— That's correct. —so that the system can look at classified documents and such. I think that's right, Your Honor. And I don't know technically what capabilities may be around the corner, frankly. I mean, it might exist now in the heart of Anthropic's, you know, engineering team. What I do know is that the whole reason Anthropic cares about this as a contractual matter is because it was not attempting to impose these limitations as a technical encoding these into CLAWD. In other words, this whole dispute, you know, is fundamentally a dispute about contract terms. We don't—as the record establishes, and I don't think the government can test, Anthropic doesn't even have visibility into how CLAWD is used once CLAWD is deployed in a classified environment. We recognize that. We still feel Anthropic still believes that its usage policies are important. They set forth in advance the company's vision of how safe and how AI should be used in a safe and responsible manner. There's no evidence that I'm aware of that the government has pointed to. And this was certainly not a concern that was raised during the negotiations that, well, what we're really concerned about is that you guys are going to be looking to factor these contract limitations into the model training—into the model training itself. It's uncertain whether those things are part of a model. And you said you don't know whether some of these things are in the model or could be part of the model. There's a fundamental black box aspect, right, that you don't deny. That's right. That's true of all—that's definitely true of all AI models. And, again, my answer to that is if we can't—if we, Anthropic, cannot convince the government that we are presenting a product to you that is transparent enough for you to accept the risks of its use, then you shouldn't purchase it. That circles back to the point that jumping, as Judge Henderson, all the way from a contractual disagreement or a product that the government doesn't want to buy to a supply chain risk designation is, I think, is a bridge too far as a statutory process matter and as a statutory—as a substantive matter under the statute as well. Judge Rowe, any other questions? Judge Henderson, any questions? Judge Henderson? I'm sorry. I'm sorry. Okay. Any questions? Yeah. Or we let Mr. Dunbar sit down? Yeah. I didn't hit the—whatever bar I was supposed to hit so you all can hear me. I'm back at the definition of supply chain risk. And Mr. Dunbar, I just want to put down your position as far as what work the word sabotage actually maliciously, which then modifies all of the things that follow in the same way in Fisher versus the United States, which, by the way, indicated Judge Katz's—the work that the word corruptly did in that statute. Your Honor, I do think that is the correct and best way to read the statute. Just to simplify it, in other words, there's got to be some malice, sabotage, bad motive, manipulation so as to surveil, deny, disrupt, or otherwise manipulate. I agree, Your Honor. I emphatically agree. I think every verb in that sentence, frankly, with the exception of extract, and I think that depends on whether you read malicious as modifying it or not, connotes an intentional act. And so as to surveil, deny, disrupt, or otherwise manipulate, I think puts an exclamation point on that at the end of the statute. So the government's position that this is not about intentional acts designed to undermine American interests I don't think is textual. As I said before, I also think at the end of the day maybe the statutory debate doesn't matter that much because that's their theory, that Anthropic is the adversarial hostile actor. That's the basis for their decision. If the court doesn't think that holds up as a Chenry matter, you would hold the designation unlawful and send it back. In Judge Henderson, the other point I'd make is I think that reading of the supply chain risk designation definition, of course, comports with the whole reason I think we have this statute, which is not, you know, executive branch agencies already had plenty of procurement tools to deal with supply products in the supply chain they might not like. This statute was enacted to do something different, which was to create a whole-of-government approach that might involve classified information, classified intelligence assessments to redress threats that were otherwise invisible to the procurement system in some way, whether that's Kaspersky or the Huawei examples that we cite. And so I think statutory text structure and context all support the reading of the statute you're suggesting, Judge Henderson. Thank you. All right. In other words, subversive. And that's all I want to add. So thank you for your answer. I agree. Thank you, Mr. Dunbar. We'll give you the follow-up. Thank you. Ms. Swingo, good morning. May it please the Court? Sharon Swingo for the government. I think it is clear that ANTHROPIC has the technical capability to interfere with and even prevent the Department of War's use of its AI model for critical military operations. It is undisputed that DOW uses ANTHROPIC's model throughout its systems, including highly sensitive and classified systems for mission-critical tasks. It's undisputed that the failure of the model in active military operations could have catastrophic national security consequences and put service members' lives at risk. It's undisputed that ANTHROPIC can change the behavior of its model by setting model weights and encoding specific behavioral constraints. It's undisputed that those model weights and guardrails have caused AI model to fail in real time without the government knowing about that until the point of failure. It's undisputed that ANTHROPIC would not agree for its model to be used for all lawful purposes, although the Department of War had deemed that critical for national security. And it's undisputed that ANTHROPIC leadership raised objections to the potential use of its model in an overseas active military operation, even though that was permitted by the existing usage policies. Would the government have a problem if ANTHROPIC encoded into the model an all lawful use limitation? I think the concern, Your Honor, is that given these undisputed technical capabilities, the question becomes, can the department trust ANTHROPIC not to encode limitations that would go beyond lawful uses in a way that could have... Can they encode bans on lawful uses? I think if the department had the trust that, you know, the guardrails would be limited in that way, that was not the objection. The objection is the concern that there will be red lines imposed that the department is unaware of. The red line was lethal autonomous warfare. I don't think that's actually entirely accurate. And domestic surveillance. Those were the initial red lines that were identified in the contract negotiations, but those were not the only red lines identified. If you look at JA-416, for example, Undersecretary Michael explains that in the contract negotiating meeting on December 4th, 2025, ANTHROPIC's leadership expressed that even during active military operations, DOW would have to call ANTHROPIC in real time to seek authorization for a use exception to one of their red lines, which was not prohibited by law. So I think as part of these discussions, as they went on, the very real prospect of new red lines, in addition to the two that had been identified, was a risk that the department was not willing to take. I get the point. I get the point about the need for trust. The models are hard to test. You've had a couple of recent controversies about whether the model was working the right way. But lethal autonomous use restriction, I mean, the contractors, you know, we sanction lawyers who use AI without checking it because it hallucinates. And they're saying this model, we're doing the best we can do, but this model is not reliable enough to tell it, you know, which bombs to drop. I think the concern, Your Honor, is that the department lost faith that ANTHROPIC's view of how limitations like that should be applied in training the model and in setting the guardrails. It made clear that there was a very real sense in which ANTHROPIC did demand an operational veto in the sense that it felt that its own perception of what a lawful use would entail should override that of the department. And I think the concern, given the opacity of the technology, is that use limitations could be built in in a way that would deny in the field, in real time, the ability to carry out operations that the department thought were lawful, but perhaps ANTHROPIC did not. I take those points about trust. I think that's reflected in the record. Why a supply chain risk? Why not use one of the other mechanisms to simply stop working with ANTHROPIC, as Mr. Dunbar suggests? So, for a couple of reasons. I think there was an exigent need to act quickly here for several reasons. First, if you look at how the supply chain risk determination was then carried out, the memo that was sent out, the ANTHROPIC's model was deployed on multiple platforms across DOW. They were not under some kind of integrated unified command. Models were being deployed at various times on those particular platforms with the go-ahead of that platform in particular. And so, in fact, it turns out that different of CLAWD models were on various platforms. The way to get the entirety of the department aware of the risk at the same time and able to move quickly required this kind of supply chain designation. What about the memo, I forgot, which, you know, the memo that goes out to all parts of the Department of War that relies on a number of statutory authorities that says basically, you know, take CLAWD out of all uses? Right. Why do you also need the supply chain risk designation to issue a memo like that? So, I think this is precisely the kind of circumstance, frankly, that the statute is designed for, which is to say you become aware that something that is embedded in the department's systems, critical systems, nuclear systems, targeting, military active operations, classified, poses a risk of which the department was heretofore unaware and needs to be removed as quickly as possible. The effect of the determination was to put the prime contractor on notice that it needed to immediately cease access for anthropics engineers, which was done within a matter of a couple of days after the determination. It put the entire department on notice that it should not be accepting new model versions in the interim. It put people on notice that they needed to be moving as quickly as possible to get substitute AI models to be integrated into the system in lieu of anthropics model. How is the government unaware of lethal autonomous use restriction? When you started working with anthropic through the subcontractors, the use limits were much broader than that. And this is a point on which they never budged. Correct, Your Honor. I will say initially the bulk of anthropics sort of presence within DOW systems was through prime contractors that had plugged in the AI model into the system. And so the department was not dealing directly with anthropic. It was only in these sort of late 2025 discussions where the department was contemplating bringing anthropic in as a prime contractor for the first time that these sort of usage restrictions really became a matter for discussion. And, in fact, if you look at anthropics declarations speaking to the prior use restrictions, which, as Judge Katz, as you pointed out, are quite significant, their theory is that the department was aware by virtue of using the prime contractor, and the prime contractor had agreed to these usage restrictions with anthropic that it had necessarily sort of accepted them. But, in fact, in point of fact, it was only when these direct contract negotiations took place with the endeavor of bringing anthropic in as a prime contractor that the precise usage terms really became a focus for the department. And then, of course, as these negotiations went on, there were increasing reasons for the department to become aware of the nature of the risk that was posed, ranging from discussions by anthropic about new potential red lines to, you know, the use failures in the field to increasingly contentious and hostile negotiations with anthropic directly. And at the end of the day, the department just lost trust that it couldn't be sure that anthropic would not be putting these red lines into its model in a way that could only be known in practice. The specific examples we have of disputes or the model doing either too much or too little, depending on what people want, are the CDC incident, the classified, reading classified documents, which are instances of the model doing too little. And then there's one example of anthropic thinking the model is doing too much. Both parties describe that in vague terms. There are newspaper articles in the record that describe something of that nature in very specific terms. Do you want to talk about any or all of those specific? On the last point, I would point the court to the first Undersecretary Michael declaration, which notes that without speaking to any particular military operation, that anthropics executive had raised with the prime contractor a concern about the use, potential use. Could be tremendously concerning. But one engineer and they have testimony that the CEO told the secretary that that was not, in fact, a concern. And I will say we did point to those specific examples of kind of real-time failure, because, of course, that is the concern that is the most significant for the department, is that a real-time failure could have just enormous national security consequences. I would also point the court, though, I mean, anthropics declarations speak to the ways in which the model has either worked or not worked in practice, presumably in accordance with the model weights and the guidelines that have been incorporated. So, for example, Jared Kaplan's declaration says that after the initial deployment of the model, refused to analyze classified information, classified documents, that those model weights were changed and the guidelines were changed, and that after that change, it failed less often. So those model weights are still impeding sort of the proper functioning. There is discussion throughout of the ways in which when the department attempted to use the model and it didn't successfully work, either Anthropic would work with the department to do prompt adjustments to change the prompts that were being given to try and override sort of the red lines, or would, you know, take that back so it could be changed in the next version of the model. I mean, it is very much the. The overall impression is that things are working as well as they could, and Anthropic is cooperating and trying to work all that, all those glitches out, except for the lethal autonomous warfare point. So, I don't think that's quite true, Your Honor. I think what's clear is that Anthropic refused to allow a contract term, and presumably because it was not going to adjust its model to conform to that, to be used for all lawful purposes. And as this court recognized in its state procurium decision, that was something that the secretary had deemed critical for national security, and yet Anthropic flatly refused to do it. It is certainly the case that Anthropic has identified only two limits, although what exactly it means about autonomous lethal force, I want to be clear, I understand their restriction to apply to the nature of the force, not the target of the force, so presumably that would have ramifications even for the use of lethal force against, you know, a purely property target. I think it's not clear. But I do think that sort of where the rubber hits the road is how those restrictions are actually encoded into the model, and I think the department lost trust that that would be done in a way that was consistent with our need for that AI model to be functioning in what often could be active military operations. Can I, do you mind if I switch courses? So I also, I just want to understand the government's position on some of the jurisdictional and reviewability questions. So 1327 strips us of jurisdiction to review actions under 4713, except for covered procurement actions. So what are the covered procurement actions that we're reviewing here in the government? So we have not disputed that at a minimum we have deemed Anthropic ineligible as a prime contractor for the Department of War and have now excluded them as a subcontractor. So should we view the covered procurement action as a blanket exclusion? I think that's a fair way to characterize it. And so another thing that I'm also trying to understand is it seems to me at least one reading of 1327 is that this court can't review designation decisions because a designation decision standing alone is not a covered procurement action. Mr. Dunbar says in reviewing a covered procurement action that we have to think about whether the designation was both procedurally and substantively lawful. So I'm wondering if you can speak to how we should think about the connection between the procedural and substantive reasonableness of the designation in the context of reviewing the covered procurement action. Because I do think, I think this is an important question because jurisdiction stripping, you know, Congress has stripped us generally of jurisdiction over 4713. So I think we have to be quite careful about that here. We absolutely agree that there has to be a covered procurement action as a necessary condition for this court's jurisdiction. The government has not resisted the idea that in reviewing that covered procurement action, the court would also look to see whether there was the predicate determination that would authorize that covered procurement action. So you don't resist that? We have not. Okay. Is the action embedded in the March 3rd determination or do you need the March 6th implementing order? I think it is embedded in the initial determination. And if one looks at that determination, the secretary did make a separate determination as to the scope and also that all the class, as to the class of procurements that are covered. Scope is part of what is part of a determination under the statute. So we do have to sort of read it more broadly. Like one way to read the March 3rd thing is that it's just marching through the statutory requirements of how an entity is designated a supply chain risk. I think there's, I mean, there's a separate class determination. It's kind of in the middle of the page at JA-177. The use of Section 4713 authorities will apply to all covered procurement actions involving the covered entity. So in my reading, in our reading, that is the... Which parties do you agree as to that fact, that that is a covered procurement action? Obviously, we can't give the court jurisdiction that doesn't have, but we do understand that to be the covered procurement action. Now, as to how that then is implemented, I mean, I think there are some hard questions if it takes time to implement that as to subcontractors, but at least as to the exclusion of Anthropic as a prime itself and then the directive to prime contractors to exclude it from its subcontractors on DOW contracts. I think that's right. And also, I guess just briefly on the reconsideration petition. So there's reconsideration that's pending before the department. What is the status of that? Does that affect our jurisdiction here or our ability to review? So I don't think the mere fact of the reconsideration renders this somehow incurably premature. It is still pending. As the court is aware from our letter, we were actually unaware, by virtue of them failing to send the correct email address, that it had been filed, but it is now being considered. It is, to answer your question, Judge Kessler... There was no action on Sunday or Monday on the... There was no action on Sunday or Monday, and, in fact, because we were unaware until May 8th that it had been sent, that process has just started. And so I don't think the court would... or the department would hold itself to that initial 30 days when it was unaware for the great bulk of that 30 days that it had been filed. Now, if the court... if the government were to sort of grant reconsideration, I could see that that might well impact this court's consideration, but unless and until that happened, I wouldn't encourage the court to do so. And, of course, if the government denies reconsideration, then, you know, what remains the legally operative thing here would be the initial 4713 determination and the covered procurement actions. Do you want some sort of informal stay pending the reconsideration? We haven't asked for that. We do think that the... If court is slow enough that you probably... that would be our hope, although if you're going to move more quickly than that, I guess we would ask for some sort of informal stay, Your Honor. If I can turn to just a couple of anthropics points this morning, they have repeatedly argued this morning that there are less intrusive measures that could have been taken, and what they point to are a couple of things. The first is that we could have just effectuated this exclusion through contract means, through contracting cancellations, through imposition of, you know, new conditions on our prime contractors as to subcontractors. With all due respect, that is no less intrusive than what happened here. If the secretary had issued a public statement on March 3rd and said, we don't trust Anthropic anymore, we think they're a risk because they can't operate, we can't be sure they'll operate the way we're going to, so we're going to cancel all of our contracts with them and also not let them subcontract on DOW systems, I think that would have been no less intrusive than what was done here. Maybe, but maybe it's a formal matter, but there's a statement here which is magnified by some of the more inflammatory statements by the political actors. With respect, Your Honor, I don't think there would have been any impediment to the same rhetoric being used in a statement that we were to cancel all of our contracts. I think the real problem would have been that that would not have happened in the same quick, uniform, department-wide way that we were allowed to do under 4713 and could effectuate quickly under 4713. And what about the other point about... No new models. I'm sorry? Anthropic said we could just decline... No, no, no, no, I don't... AI evolves pretty quickly. What about... Presumably, even the Department of War does a lot of functions that don't come close to lethal autonomous operations. Would it be a less restrictive option reasonably available to allow use of FOD for all of the routine administrative stuff and not the warfighting stuff? Well, I think this is the kind of platform by platform or program by program approach. Whatever it is. Certainly, the record shows that when Anthropic is deployed on a system as, for example, the platform that it's, the AWS platform that it's on, it operates as a plug-in to restrict all of the uses of that system. So I think just as a practical, technical matter, that is not really a solution. Help me out on the technical aspects. What's a platform? Is that a DOD-wide computer system or is it something more local? The main platform that it's currently, I mean, it's on multiple platforms within the department, or at least it was at the time of the designation. If a platform is equivalent to the Civil Division email system versus the DOJ email system, like, no problem. It would be very easy to look at. It's not clear from the record, but my understanding is that it's not so easy to disaggregate that platforms can be used for multiple purposes. And because the restrictions apply to any use within the platform, the concern is that it would, it's not readily segregable in that way. Okay. All right. If I could speak to the six-month transition period that has been pointed to as a real somehow in conflict with our position here, I will say, you know, obviously the directive to remove anthropics model within six months directed the relevant parts of DOW to prioritize its removal on particularly sensitive platforms, the national security sensitive platforms for nuclear use, for classified use, for active military operations. If you could address, I think one of the strongest arbitrary and capricious arguments that anthropic has is that the secretary relied on this fact or manipulation point, and that point seems to be factually incorrect. And so under our precedence, we have to be confident to uphold an action as reasonable when one part of it is found to be incorrect or mistaken, that the government would have taken the same action without that fact. So, and I don't take the government to be disputing that there isn't this sort of backdoor access once plot has been delivered, you know, once a model of plot has been delivered. So I guess what is the strongest argument that the government has that it would take this decision even without that capability? So I think the first thing I would point the court to, I think their description of what we characterize as an operational veto is not an accurate description of what was meant. If you look into the risk analysis, and one place this would appear is JA 182, the risk analysis says, by embedding unreasonably restrictive terms that restricts DOW's warfighting operations beyond the limitations imposed by law, anthropic seeks to grant itself an operational veto. And that is not speaking about, you know, interfering in the midst of operations by doing something at that time. It's talking about the restrictions that are embedded in the model themselves. There are two different rationales. One is that anthropic might embed restrictions in future versions of the model, and it's very hard to test and you need to rely on trust. A different one is that anthropic can get into the model currently in use and mess with it in real time. My understanding is the stated rationale rests on both, and one has been disproven and one remains live as your primary argument for non-arbitrariness. The concern was the risk for a backdoor, and certainly anthropic has said it does not have currently a backdoor. I think that doesn't take away a risk that they could put one in in the future. And if I could point the court to a couple of places that would perhaps justify the concern about that risk. They have backdoors for commercial users. They were pretty adamant about no backdoors for DOD, and they'd probably be committing criminal offenses if they backdoored into a classified system. Without DOW assent? Presumably, yes. Although, of course, DOW's use of this product is not limited to classified systems. Is the concern about embedded biases or embedded problems sufficient? I think it is, Your Honor, and I think that's clear both from the risk assessment itself and from the declarations by Undersecretary Michael. But if I could just add one more point, though. I do think both the suggestion by anthropic's leadership that DOW would have to call anthropic in real time to seek authorization, I think that was a reason to be concerned about a risk of real-time interference. And I would just point the court, if I could, to one other place that is not cited in our brief. At JA220, this is an internal memo from Dario Amode, the CEO of anthropic, describing how they had discussed with one of DOW's prime contractors that perhaps they could implement safety measures, a safety layer that would involve anthropic engineers reviewing the use of the model in real time. And so I do think there was a basis for being concerned about the risk of real-time intervention. But again, I don't think that was the focus of the department's concern. I think— So you think the fact that there isn't currently a backdoor doesn't undermine the idea that there's a risk of some backdoor in the future? Correct, Your Honor. Let's talk about the statute. Contrary to law points, there's two strings of verbs in the statute. If we take a literalist approach and pick the verbs, the two verbs that are most favorable to you, and the dictionary definitions that are most favorable to you, you win. But if you read this in context, a lot of these verbs do have some connotation of bad acting. Sabotage introduces neutral, but it's modified by malicious, maliciously extract, manipulate. And then in the second string, deny seems to be neutral, but surveil, disrupt, have this connotation, manipulate, might or might not. Why shouldn't we apply a use of generous approach to this statute where at least a majority of the verbs seem to have that connotation? So I would not agree that a majority of the verbs have that connotation, even if one thinks that sabotage and maliciously introduce do. I think no one has suggested that extract just means to remove data or otherwise manipulate. Neither one of those is obviously connoting some sort of malintent. And frankly, deny, disrupt, or manipulate function, again, I think that's describing a consequence, not a malicious intent. And I do think to step back, I think it would be passing strange for Congress to authorize the removal of a supply chain risk, a significant supply chain risk, but only if it was put in with malicious intent, even if it had catastrophic potential national security consequences for use in practice. I just don't think that's a—certainly Congress may have been focused on bad actors at the time and enacted the statute, but it did not enact that kind of limiting language. And again, I think it would be sort of truly harmful to the national security to put in atextual limitations on the Secretary's authority to respond to significant supply chain risks. Do you think it's atextual to read—take the first string, you're not relying on sabotage. I don't think you can rely on maliciously introduce. You're not relying on abstract, so you have this residual otherwise manipulate clause. To me, manipulate is ambiguous. It can mean something neutral. It can mean something nefarious. You read the otherwise clause in light of everything that precedes it, a la Fisher, doesn't really seem atextual. Your friend's reading doesn't seem that atextual. Well, if I may, Your Honor, frankly, I don't think the court needs to decide this, because we are responding to a risk that any person may manipulate the design or operation of this AI model in a way that disrupts or interferes with its normal functioning. And, of course, the very concern here is that there is a risk that Anthropic, you know, against the wishes of the DOW and without DOW's knowledge, would embed restrictions into its model that would prevent it from working properly in critical military operations. Quite openly and for understandable and honorable reasons. Well, I think the concern— It doesn't sound manipulative. I think the concern that was animating the Department of War is that it would not be openly and that there would be red lines built into the model of which DOW was unaware in practice or beforehand until they operated in the field to cause the model to fail under critical circumstances. I mean, certainly Anthropic was open about the red lines that it identified as not being willing to agree to. But I think the concern was that those would not be the only red lines or that those would be embedded in a way that caused the model to fail more broadly in critical circumstances. Suppose this were only a dispute about lethal autonomous and Anthropic, in good faith, built model limitations—built into the model limitations that were its best efforts to ensure no lethal autonomous, which is what they told you they would do. Is that otherwise manipulating to disrupt? I do think it would be manipulating the design, yes. I mean, I think sort of the nature of these models is that you are in a black box setting with very little visibility to the government. Putting in restrictions on the use of the model that the government has very limited ability to test or know about, has very little visibility into, and it has to have a high degree of trust if it's going to be accepting the model developer as it's the entity that is developing, curating, refining the model. Okay. But I don't think, in fact, that describes the universe of the concerns that led the department to lose trust in Anthropic. Because of the other red lines. That's correct, Your Honor. And the increasingly hostile posture in negotiations, yeah. Okay. I think it's also significant that the statute says that the government has to determine the use of the authority is necessary to protect national security by reducing supply chain risk. So I think that suggests you can't read supply chain risk definition on it just standing alone. I think that's exactly right, Your Honor. And this is exactly, I mean, to return to where I started, this is a circumstance in which there is a very high degree of overlap of agreement about what Anthropic's technical capabilities are here. At the end of the day, looking at those technical capabilities, looking at what the department knew, the question was, is the degree of risk so high that the secretary feels the need to designate Anthropic as a supply chain risk? And that predictive judgment about the nature of a forward-looking risk to national security is precisely the kind of circumstances in which this court grants the highest degree of deference and in which, I think, with all due respect, we would ask this court to agree. Judge Henderson, any questions? I do have just a short one, and Ms. Swingold, it's good to see you again. I haven't seen you in cases in which I've been involved. Well, they don't let me argue anymore. Well, they should. If Anthropic, you may not know the answer, but if Anthropic did maliciously or surreptitiously encode these two limits against mass surveillance and lethal warfare, would that be a federal crime? No, I don't believe so, Your Honor. Okay. I mean, they have proprietary control over their own model. Okay. All right. Thank you. Thank you, Your Honor. Thank you. You should go. Mr. Dunbar, welcome. Thank you. I think there's three points I want to make, Your Honor. Your Honors, I would like to start with the operational veto sort of national fuel point because I do think it's the simplest path forward for this panel's resolution. I think, Judge Katsas, as you pointed out, we're not making a Chenry argument here that the pre-deployment manipulation theory is a new theory that's not in the record. We're, you know, making the analogy to national fuel itself where there were two cumulative rationales. I'm not sure whether the surviving part suffices. Precisely. And, I mean, I'd be happy to walk the Court through all the places in the record where, again, what I would call the more headline-grabbing accusation was made that we could reach any control. I'm not sure I need that, but I'll just give you my conceptual difficulty with your position, which is in a world of AI products, of course there are going to be constant new models. You can call them updates. You can call them new models, whatever it is. If there's a contractual relationship, Anthropic will be readily supplying new and improved models. There are certainly model updates, Your Honor. I think the point, I would just go back to the simple point. So it doesn't really matter whether we focus on what might happen with the one they're currently using or what might happen with the one that everyone knows they will need three months from now because AI three months from now will be totally different from AI of today. That may well be, Your Honor. I'm not sure that speaks, though, to our national fuel point, which is simply that the underlying risk analysis here, again, in Undersecretary Michael's own words was cumulative. Not one factor or risk factor standing alone would have justified the designation, might have justified the designation, he said. Now that a central or primary factual predicate for that risk analysis has been effectively abandoned by the government, I think under national fuel, the proper course is for this court to hold the designation unlawful. If the secretary wants to make a new designation based only on model training risks, the secretary is, of course, free to do so. In response to that, I think my friend on the other side pointed to, well, there's other evidence that Anthropic may surreptitiously insert red lines in the future and that it was really a central rationale, the pre-model, the pre-deployment model manipulation theory. And again, I think under national fuel, that's all largely beside the point. The point is simply that there was a primary central justification that we've established is factually incorrect. The reference to backdooring in the future doesn't conceptually make sense to me, Judge Rao, because what our declarations establish is that when CLAWD is deployed in a classified network, it's air-gapped, which means that system is not connected to the public Internet in a way that Anthropic would have access to the model without the department in some way granting access. So the sort of speculative risk that we could backdoor in the future doesn't really hold up to me, and I think that's why the government maybe spent a sentence on it, I think, in the red brief. The second point, though, I'd like to make is that the government has talked a lot about trust, and I think this goes back to the statutory point a bit, but the loss of trust in a vendor, if that's what happened here, I think is really a poor fit for the supply chain risk designation. A loss of trust in a vendor, of course, can be dealt with through ordinary procurement authorities. Presumably, federal agencies across the government do that every day, every year, all without having to resort to a supply chain designation to address that loss of trust. But fundamentally, we don't dispute that AI models have a degree of opacity to them that is unique. That's why Anthropic strives to be transparent. That's why we strive to work with our federal partners in developing and training the model. But if the government or the department isn't satisfied with that, again, the solution is to walk away from the contractual relationship, not to punish us or blacklist us as a threat to national security. The third point on the ordinary procurement point, Ms. Wingle suggests that, well, there was real exigency here that justified moving, you know, very fast. And as we've explained, I think the exigency considerations cut in the exact opposite direction. The Secretary's decision to wind down the use of CLAWD over six months, I think, is inconsistent with the claim of exigency. It suggests that they didn't, in fact, discover that Anthropic was a queer and present danger as a sabotage threat. It suggested they wanted to move away from CLAWD in the use of military systems, which Anthropic was prepared to accept as a natural consequence of its insistence upon these contractual limitations. The six months was an outer limit. The order was remove these products as soon as practical. That's correct, Your Honor. And part of that was presumably because of ongoing Operation Epic Fury. I think our point is from a process standpoint at a bare minimum that suggests the Secretary could have given us the 30 days of free designation notice and an opportunity to respond. But I think more generally, the record tells the story here that this was a slow-burning dispute. They had known about these contractual limitations for a long period of time. I think Ms. Winkle was very careful to say the Department was not unaware. She simply made the factual point that these restrictions were in our contracts with AWS and other prime contractors. And that's presumably because it would be surprising to learn that the Department of War was actually using CLAWD on military systems without any understanding of the contractual limitations that its prime contractors were under. So this is—again, we set forth declarations in this case establishing that these usage restrictions, which were broader than the ones that we're insisting upon today, were open and on the face of these contracts. The Department accepted them and lived under them. We negotiated with the Department for six months over these contract terms. Those negotiations continued even after the social media posts. The negotiations continued even the day after the written determination with Undersecretary Michael emailing Anthropic's CEO saying we are very close and I hope this works out. I think that is fundamentally inconsistent with the idea that Anthropic is a hostile party or saboteur and fundamentally undercuts the basis for the government supply chain designation. But fundamentally, my last sentence. I saw that I had maybe reached the end of my time. The bottom line is that the Secretary acted without process here based on a factual premise that his brief no longer defends. And in these circumstances, I think that is the simplest basis for this court to hold the designation unlawful. Judge Henderson, any final questions? Oh, I'm fine. Thank you. Okay. Thank you. Thanks to both counsels for the helpful arguments. The case is submitted.