# Oral argument — Military-Veterans Advocacy v. Secretary of Veterans Affairs > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/argument%3A96046 ## Record - **Collection:** Oral argument - **Document type:** Oral argument - **Published:** January 7, 2025 ## Text Well, thank you all for being here in the snowy weather with us so that we can see you in person. We enjoy and benefit from these in-person arguments tremendously, so we're glad that you were able to to do this. We're also very excited to welcome Chief Judge Rodney Gilstrap of the Eastern District of Texas to sit with us by designation today. We only have at the very best and we got it today, so we're happy to have him join us. So let me call our first case. 23-1413 Military Veterans Advocacy v. the Secretary. Mr. Millikin, please proceed. Thank you, Chief Judge Moore. Good morning, your honors, and may it please the court. We're asking the court to hold two narrow subsections of the VA's 2022 rule unlawful. These provisions assert sweeping authority but lack any basis in statutory text, nor as best we can tell do they have any counterpart in the rules of any other agency. No one else claims the authority to subject users of its IT systems to warrantless searches and standardless background checks. Actually, hold on. When you say no other agencies, I mean technically we're not an agency, but we do. Did you have to go through a metal detector and was all your stuff scanned before you walked in here? That's correct. Did you have to go through a background check to be able to stand here? A background check when I applied for admission to the bar. Fair enough. And so your personal items were searched to enter the building? That's correct. So what's wrong with that? Well, what's wrong with that is that what the VA is claiming the authority to do here is to inspect the entirety of the computer equipment that's used to access the VBMS and also any location in which that computer equipment happens to be located. You may not know this, but the entire judiciary has a policy and every user of the judiciary's network accepts that policy. Every time I log on to my government account, I have a pop-up screen that tells me I have no rights to privacy and the government can inspect the device. Every time. Every single time I log on, I have to click okay before I'm allowed to continue. And that gives the government, if I'm using a personal device, the right to inspect my personal device. If I'm using a court device, the right to inspect my court device. It's letting people know that by accessing the court's network, you are no longer guaranteed those rights of privacy. So are you saying, does that feel also unconstitutional to you? No, because your honor, the court staff is not entitled to come into your home unannounced and without a warrant just because the laptop on which you access the court systems happens to be in your home. And that's what these regulations say on their face. We flagged this issue during the rulemaking proceeding. But hold on, but did your clients, did they agree to it? Just like when you say they're not allowed to, don't they have to affirm once a year, every single year, that they agree to all of these potential searches? So the two individuals from which we submitted declarations, the members of NVA, they do not access VDMS precisely because of these unlawful regulations. So they have not consented. But the people who do access the system, they have consented annually to that search or to the provision that says that there can be an inspection of hardware, software, and location. They consent in the VA rules of behavior. But I want to be clear about this issue of consent. That is an issue with respect to our Fourth Amendment argument. The consent argument is not an answer to our Administrative Procedure Act argument, which is that the VA doesn't have any statutory authority to impose these inspections, even if they force users of the VDMS to sign a statement saying that they've read the VA rules of behavior and agree with them. Let me ask you this, counsel. The no-notice inspection provision, is it limited to communications and information regarding counsel that use it? Or are there also attorney-client privilege communications that are subject to V that are embedded in these devices? I mean, does this reach to the clients, not just the lawyers? That is precisely the concern, Judge Gilstrap. The regulation on its face says that the VA may at any time and without notice inspect the computer hardware and software utilized to obtain access in their location. So that's not saying just we'll monitor your access activities while you're accessing the VDMS. That might be a perfectly reasonable regulation. And we pointed that out in our response to the Notice of Proposed Rulemaking in Appendix 1181 to 1182. Can I ask you a question related to that? Certainly. How would you change this provision? What language would you add at the end of Part C? What language are you asking, would you ask for? I mean, there are some times, of course, where such an inspection, like for example, to see if somebody's Starbucks versus their home. Correct. Makes a lot of sense. But I mean, if there is the phrase, the words added, to ensure compliance with these requirements, would something like that be enough to satisfy you for all circumstances? Well, if it simply said to ensure compliance with these requirements, I don't think that that would narrow the scope of authority that's on the face of the things I would say. First, elsewhere in the rule, this is at 38 CFR 1.602C3. It says, by applying for and exercising these access privileges, the individual expressly consents to VA monitoring access activities at any time for the purpose of auditing system security. We think that's perfectly reasonable. If you're going to access the VA systems, they should be able to monitor what you're doing while you're accessing those systems. I think it would also be reasonable for the VA to put into place some sort of provision that allows them to ensure that when you access the VA systems, you're doing so only from an approved location and not a Starbucks. That could take the form of some sort of software that allows them to determine your location when you're logged on to the VBMS. It could take the form of some reasonable administrative process for them to go check on you. Do you agree, though, that the language where it says inspect the location, that includes the narrow circumstance in which you just described? I think it includes that circumstance, but I think it is much broader than that circumstance, and that is our concern. Let me ask you this. You say that this is a facial challenge, and the government says it's an as-applied challenge. I can't find any clarity in the briefing on either side that tells me how much this no-notice inspection provision has been used, the extent of its use, or anything about the real world and how it's applied or not applied at all. Can you give the court some representation as to whether this is something that's used once every two times somebody logs on, or is it never used at all, or is it somewhere in between? The briefing is just silent on the real-world application and use of this thing. We don't have access to that information, Your Honor. Our MVA's attorneys do not access the VBMS precisely because of the existence of this provision, which would open up their attorney-client privilege information, potentially, to the inspection. So you don't even have anecdotal information? I do not have anecdotal information. Following up on what Judge Willstrop just asked you, are you suggesting that this particular challenge is an as-applied challenge or a facial challenge? It is a facial challenge. So here's the problem. To succeed on a facial challenge, you have to conclude that all applications of the rule are unconstitutional. Do you agree with that? With respect to our constitutional argument, I agree. With respect to our APA argument, all we have to show is that it lacks statutory basis or that the agency didn't provide a reasoned basis for it in passing the rule. Well, a reasoned basis for it when passing the rule, I mean, if you agreed with Judge Stoll earlier that certain applications of it are completely acceptable to you, isn't that sufficient to create a reasoned basis? No, because the agency has to provide a reasoned basis for the rule that it passed, and the rule that it passed stretches far beyond the reasonable circumstances that Judge Stoll and I were discussing. But let me think about this. I'm also having a problem with this very point, which is you say there's no statutory basis for it and there's no reasoned basis for it. But if looking to see what the location is to make sure that the user is accessing it from a private Wi-Fi network, for example, that clearly falls within the scope of the rule. So why is that not a proper application of the rule? It would be a permissible action for the agency to take if they passed a narrower rule, but the agency... But in other words, like, why should we speculate as to the nefarious ways in which the agency could use this when we can see plain on the face the more reasonable ways that they could use it, and it's not until something nefarious happens that there would be an as-applied challenge? So two responses, Your Honor. The first is that we don't have to speculate because we pointed out in our response to the notice of proposed rulemaking that this was far too broad, that there was room for reasonable inspection provisions, but that this went too broad, and the VA just simply said, no, we're going to leave it as it is. So the VA is trying to assert this extremely capacious authority. That's the first answer. So we're to infer intent from the agency based on that? Intent for the agency to assert the authority to conduct these unannounced and warrantless searches of any premises on which the computer happens to be located. The second response is a higher level... You don't really contend that people are going to break down doors and go in homes and break in businesses physically. This is really about seeing what's on the computer, is it not? I'm saying that that is the scope of the authority that the VA has asserted in this case. I have no insight into their subjective motivations about how they wish to use this. But when we look at the lawfulness of agency rules, we do not look at, oh yeah, maybe this is a little broad, but we just trust the agency that they're going to exercise this power in reasonable ways. We say, what power is the agency asserting and does its enabling statute give it the power to assert that authority? You agreed with Judge Stoll that there were certain narrower location-oriented reviews that the agency could have implemented and that the real problem here is that this is just too broad. Is that right? That's fair, Your Honor. So what is the statutory authority that you think expressly supports their ability to adopt a narrower rule like the one that you said would be okay? To give you two examples, Section 5722B2 gives the Secretary authority to establish policies and procedures that, quote, cost-effectively reduce security risk to an acceptable level. I think that making sure attorneys are accessing DBMS from a private location comfortably fits within that. Section 5723A2 gives the Secretary authority to ensure that security protections are commensurate with the risk and magnitude of the potential harm. Here's the key. Because honestly, on their face, both of those could arguably justify the breadth of the agency's thing, but only if they did the risk assessment. That's a piece I have found not to have occurred here, right? Agreed, Your Honor. So explain that one to me again. Do you agree? Explain that last one, the 5727A2, because I kind of cut you off and I didn't mean to. I just got excited. So explain that one again. Well, so the 5723A2 says that the Secretary should ensure that information security protections are commensurate with the risk and magnitude of the potential harm. And then in 5722B2, it says that the policies and procedures that are promulgated pursuant to this authority have to be based on risk assessments. That's a separate basis for our challenge to these rules, which is that there's no indication that these policies were based on risk assessments. So let me just say, I think arguably, when I look back at what they did, that they arguably articulated a risk assessment for the background check. So let's just put that to one side. You just assume that I think that. But I am struggling to see where they did a risk assessment on the scope of the location, no notice, and search. I don't believe there is one. And I've looked. Yeah. I mean, the background check thing, I just don't understand why you're fighting that piece. Why? What's wrong with the background check? I mean, we don't hire a single person here to work in the federal government that doesn't have a background check. The main problem with it, Your Honor, is that it's unnecessary. The VA already- No. The staff. The staff. This provision was broadened to not just apply to attorneys. It applies to staff. Correct. But the VA will already provide attorneys access to these records on CD-ROM or in hard copy solely by saying, I'm an attorney. I'm in good standing with the state bar, and I represent this claimant. And all they're doing is imposing another more onerous layer of regulation if you want to get the more convenient form of access that VA supplies. No, but it's not just more convenient. You know why? Because just about anybody can hack in and see other stuff. So if I give you a piece of paper, the limited universe at which you can expose to the risk of public disclosure is limited to what's on that piece of paper. When I give you access to a database, it is way harder to be confident about controlling your limit and limiting your access. That's fair, Your Honor. But when the VA accredits individuals to represent claimants before them, they will presume the character and fitness of attorneys who are in good standing with the state bar and will presume that that individual is going to protect client confidences, protect the VA's confidential information, conduct themselves appropriately- With regard to the client who hired them, but not with regard to all of the data. Don't worry about the time. Not with regard to all the data the electronic system has within it. Correct. But individuals who get access to the VDMS get access only to the records of the specific individual- Unless they're good hackers. That's the problem, right? That is the whole cyber security problem. You're only as strong as your weakest link. And yes, we are theoretically narrowly giving them access to these records, but really good hackers can probably gain entry to the entire system that way. That is why we have limited access. Correct. But again, in other circumstances where very sensitive information is at stake, the VA is content to presume that attorneys are not going to violate their ethical obligations and their duties as an officer of the court- What is the standard that you have to show? You have to show that it's- What is the standard that you have to satisfy? In order to show that it's unlawful? Yeah. We have to show that it lacks a statutory basis. That's our statutory- Argument. Okay. Or that the agency did not provide a reasoned basis for the rule and the rulemaking record. It's really hard. That's a hard standard to satisfy for just a background check. Actually, this is a very important point. I recognize I'm well over time. No, you're not over time. You're good. It's a hard case. Go ahead. So the VA's sole justification for imposing this background check requirement is that the VA has that they have to do it because of this Homeland Security Presidential Directive 12 and an accompanying Office of Management and Budget memo. That's the only justification for the rule that they have provided. That directive and that memo do not apply to mere users of federal information systems. They apply to federal employees and contractors. What about the OMB circular? Didn't they cite the OMB circular as well? In the briefing, they have relied only on these two OMB memos that implement the Presidential Directive. That's all I understand them to be relying on. Well, I look at page A, for example, which is where the actual rule is, and it refers to OMB circular A-130, which in turn refers to implementing control access policies for information resources that ensure individuals have appropriate authorization and need, and that appropriate level of identity proof in your background investigation is conducted before granting access. It's not just for federal employees. I don't know if you have that document, but it's cited in the rule itself. Circular A-130. I don't... It's not in the context. I see the reference to it in the rule. I do not believe that this is in the rulemaking. I see that it is included in the amended index of rulemaking record at Appendix 21-26. It is not in the record, and so it is not something that the agency has relied on in defending its rule in this court. I want to go back to the no-notice provision, because quite honestly, that is the most troublesome to me. Is there any data or any information that indicates how many times this access takes place subject to the no-notice inspection where the actual adverse party is the Secretary of Veterans Affairs as opposed to whether the access to the data and the purpose behind seeking it is related to litigation in which the Secretary is not an active party? Because it seems to me you're basically taking an adverse party and giving them unfettered access to everything on the other side's computer. Now, if that person who's the gatekeeper and who has the unlimited inspection authority is not a party to the litigation, that's a whole different kettle of fish. Is there any indication as to how much of the time we're talking about litigation or potential litigation that directly involves the agency, the Secretary of Veterans Affairs, as opposed to other litigation or other proceedings in which the Secretary would be a non-party? As far as I'm aware, this VBM access is only for proceedings in which the VA is the adverse party. It is, this access is for individuals who are representing veterans who are asking the VA for service-connected benefits. So, you're not aware of any circumstances where counsel would be accessing this subject to this no-notice inspection for purposes that don't involve the Secretary as an adverse party? I am not aware of any, Your Honor. Okay, thank you. Mr. Milliken, let's hear from, how do I say your name, counsel? Loughrigan. Mr. Loughrigan, let's go. Thank you, Your Honor. Good morning, and may it please the Court. The final rule should be sustained. To begin, the petition is defective because it raises as-applied challenges to the final rule as opposed to a facial challenge. All of the arguments in the petition are about how the VA is going to respond. A facial challenge, however, has to be independent of the individual. They have to show that there's no set of circumstances under which the regulation would be valid. Can you help me, first of all? I just want to know, can you tell us a little bit about the type of documents that can be accessed by somebody on the VA IT system? Like, can they access documents of other veterans other than those they represent? And what sort of confidential, what's the nature of the confidential information? Are we talking security numbers, social security numbers, and things like that? And also, a related question is, well, let's start with that one. Sure. To begin, in VBMS and Case Flow, the types of documents that are housed there include sensitive medical information from veterans, their financial information, social security numbers, all sorts of personally identifiable information. So, given that this information is subject to VA's control, it's within VA's internal, it's one of VA's internal systems, to make this available to outside people requires a very, sorry, significant sensitivity to the risks associated with that type of disclosure. I mean, VA is under a statutory duty. If I could get on the system, would I be able to, would I be limited to access only my clients, or do I just make a representation that that's all I will use it for? As I understand it, it's just limited to your own clients. Like I would not be able to access other information unless I used, unless I hacked in some way. Okay. The way you're supposed to use it should just, would be limited to your client. You wouldn't be able to access other veterans who you didn't represent. Could I, if I ignored my ethical obligations, would I be able to access the information of other veterans? I don't believe so. Okay. I don't believe you can. Is that, I guess you couldn't, or is that I'm sure you could? It's not, it's set up for you to only access the records of your own client. Okay. So we're talking about within the realm of how it's supposed to work. That's how it's supposed to work. That's not an exclusion of how it might otherwise work if intentionally mishandled or misappropriated by someone. Oh, if it's mishandled or misappropriated, or someone's an expert in hacking, then there's all sorts of information that they could gain access to that they don't have any entitlement to see. Let me ask you this, counsel, in the risk assessment that was done as a part of the adoption of this no-notice inspection rule, in the appendices that we've been furnished with, I see lots and lots and lots of spreadsheets, and they don't tell me anything. I can't make any sense out of them. What really was the basis for the substantive risk assessment that led to this adoption of the no-notice inspection? Well, the risk assessments that are contained in the supplemental appendix are risk assessments of the systems to which one would seek access to as a part of... I mean, you're talking about a spreadsheet with this is filled in, that's filled in, this is blank. They're little two, three-word insertions that they don't, at least for my limited ability, they don't tell me anything. In other words, is there a particular page that you would identify for us that talks about the risk assessment for no-notice inspection? I don't see it either. Well, the risk assessment isn't for necessarily for the no-notice, it's not the right to inspect provision, essentially. The risk assessment is for the system. It's for a VBMS and case flow. So what are the potential risks? And this is done according to risk standards. So you go through the various types of risks. There are environmental risks, potential that there's going to be lightning, potential for hacking, the potential for risks associated with remote access to these internal VA systems. And the risk assessment for that... Those risks are the risks inherent to any database with sensitive information. And so how are those tethered to the VA's decision that they could, with no notice, come into your home, inspect your home, your hardware, your software, and everything on your computer? That's what you have to have a risk assessment for, right? The risk assessment isn't just, I have a sensitive system. Because you know what? I've got a lot of sensitive stuff in my computer, but I don't have the right to go into one of my, even my employees' homes and search their homes. That's absurd. Well, there are two issues. One, to the extent that you say, this is my system and I want to give somebody, my employee, access to it. And you say, well, I'm only going to give you access to it if I can ensure that you're using it correctly and you're not using it, let's say, in a Starbucks. I mean, that's your right to do it. It's optional. The second part is what the risk assessment entails. And if you, in the statute itself, it provides what the risks are supposed to assess. And I can pull that. And this is in 5722B1. And it's supposed to be periodic assessments of the risk and magnitude of harm. To what page of the appendix are you on? I'm citing a statute, so it's not directly in the appendix. Thank you. So 5722B1 provides that the Secretary shall ensure that the Department Information Security Program includes the following elements. And one is periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the department. So for all of the VA systems, the IT staff provide, do that sort of analysis with respect to a list of potential risks and potential vulnerabilities. Some of them are low risk. It could be an outward facing system that provides blog posts or publicly available information. So the risks associated with privacy and confidentiality for those are relatively low. Are you saying then that what the statute requires is you to look at the risks that could result from the system being unauthorized, having unauthorized access, but that does not mean that you need to have also have that assessment talk about how you're going to control that risk? That's correct. It can, but I could show you. If you look in the supplemental appendix, for instance, at 46 and 47, it provides the risks associated with remote access from a separate device. But the problem is, I mean, doesn't B2 say the policies and procedures that the VA adopts have to be tethered to and based on that risk assessment? Sure. So this risk assessment determined that there is a high privacy, you know, there's a significant risk associated with... They just said basically sensitive data. That's what this risk assessment... We have sensitive data, full stop. There's nothing else in your risk assessment. This is sensitive data. So why is being able to go into someone's home and search their premises a reasonable policy with regard to the protection of sensitive data? Well, it's a reasonable policy for several reasons. Which are explained in the final rule in the explanation. I mean, so essentially the entire purpose of this rule was to expand access, was to provide more people with access to VA's internal systems to provide that benefit for representing veterans and claimants. But it's at what cost? At what cost? Provide the additional access, but at what cost and under what constraints? Well, the constraints are, you know, that people have to be staff members of the accredited individuals and service organizations. But in expanding the population of people who are eligible for this type of privilege of accessing VA's internal systems, VA said, well, we want to keep in the existing security protocols in place. So the inspection provision has been in place since 1994. So I get that. Let me just ask a point about that. I mean, it doesn't seem to me to be a reason in the law based on your newly adopted rule that they can't challenge it under APA 502 at this point. Despite the fact that it was substantively identical since 1994, I don't see anything cited to me that suggests that, for example, this challenge is therefore untimely. Do you have anything to that extent? We're not arguing that. OK. I just wanted to make sure. Just clear away whatever I can. Right. The point of saying that it's in place is part of the overall package of controls that VA has in place for protecting VBMS and case flow. So the nexus between the risk assessment and the adopted rule is the VA has sensitive information. We're going to adopt the no-notice inspection provision. Or we're going to maintain. That's the nexus. Between the risk assessment, the risk assessment that's in the record, yes, that's the connection is that there is a significant risk associated with disclosing private and confidential information associated with remote access through a separate device, which is how private attorneys and individuals would access the system. And given that, and also given the fact that there's going to be an expanded population who is eligible for this access, VA determined to maintain the existing security controls. And I can glean all that from those spreadsheets? Well, you can glean it from, that's part of the record. And so you can certainly consider the spreadsheets because the agency considered them. One question Judge Gilstrap asked the opposing counsel was, how has the VA been using these rules? And what sort of, I mean, how are they using it? What sort of inspections are happening? Do you have any information on that? I understand this rule has been in place for 29 years and VA luckily has not had to invoke its right to conduct one of those inspections. But how would VA know whether it should or shouldn't invoke? I mean, is it with the horses out of the barn and down the lane? Oh, now it's time to go inspect. Is there something that has to happen to precipitate this inspection? I mean, if you're going to use it like it's written, it would seem to me it is no notice that you would use it periodically or at least randomly to make sure that the harm you're concerned about isn't happening out there otherwise unbeknownst to you. That's a good point. But that's one really for the IT experts to explain, you know, what the precise circumstances that they'd be able to use this for. But one, there's certainly, there's a deterrent effect. I mean, the mere fact that the VA could invoke this right might have some sort of deterrent effect to bad actors. There's also... I don't want them, you know, searching my underwear drawer either. I'm not a bad actor, but I don't want them coming in my house and having some unfettered right to search the location. And by the way, what does that mean, the location? Does that mean only the room the computer's in or the whole house? And what if it's a laptop? How do you know which room I was using it in? Do you think that that's a proper interpretation of the rule, by the way? Which rule? The location rule, where it says that you can inspect the location. Do you think that that means that the VA can access somebody's house and poke around? Well, it means, I can only tell you what the rule says. Now, to the extent that there's an unreasonable search, you know, that could be objected to by somebody that would say that's outside the scope of this. You know, when it says location... I'm asking what the scope is. So what is your answer to the scope? What is the scope? I mean, you should be prepared to answer this question. The scope is to the location. I don't have more specific response to what location is. Earlier, when the rule talks about location, it talks about confirming that the location is one that has a private network. There's some language in here and different places that's helpful. And so I'm surprised you're not relying on that at all. Well, we're relying on everything that's in the record. But certainly, what the record says or the rule says is, you know, the purpose, one of the purposes is to make sure that it's being accessed from the approved location. So it's not being accessed from Starbucks. Yeah, that's what I'm saying. I mean, you wouldn't limit... Your interpretation, though, would not limit it to that circumstance. Instead, you seem to be agreeing with the hypothetical that under this rule, the agency could go to someone's home and just inspect anywhere. No, they certainly couldn't do it. You would inspect the purposes for compliance with required security requirements. I mean, that's the purpose of coming to somebody's home. So to the extent that there's nothing to do with somebody's bedroom, with making sure it's compliant with required security requirements, you know, I don't know why somebody would go in there. But these are all hypothetical situations that haven't happened. And then that suggests... I understand, but if you would address the scope of the rule, you could explain that they can't happen, that the rule doesn't allow that. So that's why I'm asking you these questions. But in an earlier time... Wait, hold on. But he hasn't said the rule doesn't allow that. He hasn't. Just to be clear, you said the rule doesn't allow that, or you'd like to interpret the rule that way. I want to know if you think the rule allows the agency to go to someone's bedroom or to inspect different parts of their house, or if it's limited to looking at the software and hardware of the laptop and the location to make sure that it's an appropriate location for access. What does that mean? Also, the appropriate location for access part, I'm going to need a follow-up on that. So go ahead. Well, first to your question, Your Honor. It means what it says. So they're looking at the software and the hardware that are used to access the VA's internal systems. With respect to the location, it's the location used to access those systems also. So you haven't answered my question. Could they go into the living room, in the bedroom, and the office? Well, that's a good question because it depends whether or not they're accessing VA systems from those locations. And that's why VA says... So if they've got a laptop and they're walking around their house, I think his answer is yes. If you come to my door and you say to me, where'd you use the laptop? And I said, well, I used it when I was in bed. Then I carried it over the kitchen and then I used it in the living room. Well, that's one of the reasons why VA... And in the rules of behavior, it says you should keep your personal property separate from your VA access equipment. And to the extent that you are using that equipment, you should use it in a place that's approved. So if you have a home office or a dedicated space where you use that equipment, that's where you're supposed to use it from. You shouldn't be walking around your house using the laptop. So you don't tell people how they ought to use their equipment when they're adverse to you in a court proceeding? Well, in the rules of behavior, which is one of the requirements for obtaining that access in the first place, they agree to use it as approved. I mean, the whole point of this is that this is all optional. Nobody has to agree to this for anything. There's no... This is all about for the privilege of accessing VA's internal systems, which are usually not available to outside people. Can you help me understand why it's reasonable to have to look at someone's bedroom if earlier that morning they had been working on their computer there for half an hour? How is that tied to security requirements? Well, I don't know if that would ever happen. And in a way, that's... I know, but you just said the rule allows it. I'm asking you, how is that reasonably tied to the goal of ensuring that access is from a place that complies with the VA's requirements? I'm not sure if it would in that case. But these are hypothetical applications. It'd be okay if it's by the office. That you have agreed fall within the scope of the rule. Say that again? That you have agreed fall within the scope of the rule. You have agreed these fall within the scope of the rule. So you call them hypothetical, but it's concerning to me because you've agreed that the rule's broad enough to cover this. And yet, you can't stand... You can't explain how that is tied to a risk of accessing... Sure, I can. ...improper access of the VA IT system. I can, to the extent that there's some sort of... Not even some sort. If somebody's using their equipment in the bedroom, and that's where they access the VBMS and case flow systems from, if that's the location, then the rule says you can periodically expect the location from which it's being accessed. If somebody's accessing it from their home office, which is a dedicated space, then they couldn't go into somebody's bedroom. Okay, well... But it depends on how the person uses their equipment. I need to... I understand. I need to head back up here. So let's just consider the challenge. Now, obviously, if you're talking about a constitutional challenge, all applications of the rule have to be unconstitutional, right? So that's a facial challenge, constitutional, boom. What about under a 502 challenge? Is he correct, your opposing counsel, when he says that he's not... That's not the way he's arguing it. All he has to prove is either a lack of statutory basis or that the agency didn't provide a reasoned basis. Is that a correct statement of the law? Is that what he has to prove in order to succeed on a facial challenge to these provisions under 502? Sorry, on a facial challenge? Under 502. Okay, well, first of all, we don't argue that it is a facial challenge, but to the extent that it is a facial challenge and the rule and the argument is that the agency acted arbitrarily and capriciously in adopting these rules or that there was no statutory authority for them, I mean, those would be arguments that the court could certainly consider. So where is the statutory authority for each, the background investigation, exactly walk me through it, and what we're calling the no-notice inspection rule? I would be delighted to show you, Your Honor. So with respect to the statutory authority for the background check, let's start there. Because one of the problems you have, of course, is your brief was written prior to Loper, right? And your whole brief is Chevron, Chevron, Chevron, and that doesn't exist anymore. So I now need you to... I'm sure it's the same provisions that you're going to point me to, but nonetheless, I want to give you the opportunity to walk me through why it is I don't just give the agency deference on what it thinks about these statutes, because that doesn't exist anymore, but rather why I think I ought to conclude that you're right about them. Okay. So under 38 U.S.C. 5722, this is the 2006 statute. Under 5722C, Compliance with Certain Requirements, it says that the Secretary shall comply with the provisions of Subchapter 3 of Chapter 35, Title 44, and other related information security requirements promulgated by the National Institute of Standards and Technology and the Office of Management and Budget that define department information system mandates. And so they're responsible for complying with the NIST guidance and the OMB guidance. Now, with respect to the NIST guidance, it's applicable to under FIPS, which is a publication provided by NIST, the National Institute of Standards and Technology, under FIPS 201, it provides the credentialing requirements needed to obtain a PIV bar. Well, the problem is NIST is limited to employees and contractors, so it absolutely does not cover these people. Okay. Well, I don't know if it's limited to employees and contractors. It expressly says this is guidance for employees and contractors. What am I missing? And with respect to the... Tell me why it's not limited to employees and contractors. I mean, I want you to have every shot to give me your best argument, so... It's not limited to employees and contractors. Employees and contractors happen to be the ones that ordinarily use a personal identification verification credential, I mean, because ordinarily outside people or people other than employees and contractors don't access internal government systems. So to the extent that there is an access, the underlying rationale to ensure that an identity is being verified prior to accessing these systems certainly applies. That's one argument. The second is in the statute itself in 5723 F1, the statute applies to not just employees and contractors, it's to users of the department information and information systems. So under F1, those users are responsible for complying with all department information security program... I'm sorry, what is the thing with users that you kind of lost me and I want to get caught up and don't worry about the time. Yes, Your Honor. It's 38 U.S.C. 5723 F. 5723 F? Yes. Okay, and what does it say? Congress directed that all users of the department information and information systems are responsible for complying with all department information security program, policies, procedures, and practices. That's F1. On top of that, on F5, they're also responsible for signing an acknowledgement that they have read, understand, and agreed to abide by the VA national rules of behavior on an annual basis. Now, in terms of the question about this authority for applying this to others than employees and contractors, the OMB guidance provides that support. Under in Appendix 44, this is OMB's HSPD-12 implementation guidance for federal departments and agencies. And where it says to whom does the directive apply, under the term employee, it provides kind of another category, which is other agency-specific categories of individuals, such as short-term employees, guest researchers, volunteers, intermittent or temporary or seasonal employees, to the extent that the agency makes that decision to make it available. And you think that includes this bullet point, includes users, any users of the system, including those who are not interns or part-time employees or anything? I mean, these are just examples. and other people who are representing veterans? Yes. So that's the textual basis for this, for the... So the textual basis is they can require users to comply with the same things they can require employees and contractors to comply with? Even if it feels unreasonably broad, I mean, even if there was no risk assessment done, do you really, is that... I'm just trying to understand... Look, I'm gonna be honest with you. I think the rule is crazy. It's absolutely crazy. I think it's excessive. It's overly broad by a lot. And I'm offended by it, especially when you sit here and tell me they can search my underwear drawer. I don't like this. I know, don't even go there. But so I don't like it. So I'm trying to figure out if you really do have statutory authority to adopt something that broad, or if there isn't some obligation that you tether the breadth of your invasiveness to an assessment of threat. And I'm just, that's what I'm not finding. I'm not finding the linkage. I think you, look, you got me on the background check. You need to waste time on that, right? That's easy. Especially because they mainly complained about attorneys and this provision expanded to staff. Done, you know? No background check was done on those staff. You have me on that. It's, I really think that this other provision is just unreasonably broad. And so what I'm trying to work through in my own head is whether that results in them winning or not, or whether even though I think it's unreasonably broad and I don't think the agency has sufficiently tethered it in a concrete way to actually protecting the database, is it nonetheless legal? That's where I'm at. Like, is it nonetheless past muster under 502? Because the constitutional thing is out. They don't win on that either. Okay, so- And major questions doctrine is a joke. So that, this is a stupid argument. Keep going. So the- So I'm just telling you, you win on all these things. No, I understand. And this is a narrow point. And that's what I'm really focused on and struggling with. Well, what, first of all, with respect to the statutory authority, we walk through in 38 U.S.C. 57, 22, and 23, various provisions on page 50 and 51 of our response brief that provide that the department is responsible for setting its, for establishing its own department information security program. And it provides various parameters. And then within that, so there's authorization for them to adopt a rule for IT security, which is what this is. Within that, what the petitioner then has to show is that it's arbitrary and capricious for the agency to have maintained this provision. And it's not arbitrary and capricious because the government considered that the reason why this was necessary and that they're expanding the population to which the rule is applicable. But I don't see that. I don't see that risk assessment anywhere. I don't see. I think that you and I could probably come up with some really good arguments about why maybe this is necessary. I probably am never going to totally agree with them, but I might have to defer to them as a matter of agency discretion. But I don't see where they did that. I don't see in the final rulemaking where they actually did some risk assessment and said why they need to go into my house to see the room in which I operated my laptop. Well, I'm going to walk back. The rule only authorizes what it authorized in terms of what can be inspected, and that's the hardware, software, and location. So this hypothetical- But the location is the place. It's the place. What else does location mean other than the place you're using the device? Well, yes, it's the place in which you're using the device. But this kind of also goes to the application part of it. First of all, it's not necessarily that somebody would come to your house. It might be a remote inspection. Somebody could do it on camera. There might be an inspection for- not necessarily to catch anybody. There's this nefarious purpose that's assigned to this, but it could also be for a lesson learned. Let's say there is some sort of breach or problem. This could be an opportunity for the IT staff to analyze what went wrong here so they can make improvements in the future. The problem isn't- I can imagine there are certain aspects of the location thing that would be reasonable. For example, if the rule were limited to to ensure the location has a closed network and is not operating off Wi-Fi, right? If that's all the purpose, we can go to location to ensure closed network. But the rule is written so much broader than that. It doesn't have those safeguards or guardrails around it, which means- I mean, I feel like we've got sort of vigilante VA police officers coming into your house, and I don't want that, and I don't know what to do about that. I mean, can't you just go back and just make this rule a little narrower? Make it sensible or more? Right now, you admitted earlier that location includes being able to go into someone's bedroom if that's where the laptop was. Well, if someone's- I don't want to admit that it's anything more than what it says, because these are all hypothetical scenarios. So it's like I admitted it. I know, but- I admitted the rule says what it says, and sorry to sound expensive. That's right, and it's broad. That's the concern. I was trying to read it narrowly, and you fought me on it. As to a rule from 1994 that you tell me you've never used. They never had to use it, and it's the right to use it. How do they know they never had to use it? How do we know? I'm going by the institutional knowledge that's provided to me by the agency. So it's never- there's been no inspection that has ever occurred? That I'm aware of, or that anyone at the agency- That the agency told you. You asked this question, and your representation from the agency is that no inspection has occurred. That's correct. Are you relying at all on OMB Circular A-130? Well, it's referenced in the final rule. And it talks about users generically. It doesn't talk about employees. So are you relying on it at all? I mean, it's not in your brief. Well, we haven't specifically- No, I mean, you can look at 5723 F1, which talks about the users having to comply with department policies and procedures. You don't need to go to- So you're telling me you're not relying on it? I mean, the final rule- It's in the rule. The rule cites it. So are you relying on it or not? It's just a yes or no. Yes. All right. I want you to know you've been very helpful. It's a hard case. And you can see that we're struggling with it. And so I don't want you to walk out of here and feel like, oh my God, I did a terrible job. You didn't do a terrible job. You did a great job. Thank you. Yes. I want to be helpful. You were sometimes helpful. You succeeded in part. Maybe a little room for growth. But anyway, no, I'm kidding. You did a good job. Thank you so much. Thank you. You don't have to worry about talking. Give you some latitude, but let's not be here all night. All right. I'll be concise here. I've got a question for you, sir. Yes, of course. Have you ever said to the other side, let's just change the rule? Let's just put unreasonable suspicion or some kind of condition on this? Yes. And have they refused to negotiate with you and just said, no way, OK? In responding to the notice of proposed rulemaking, we said at appendix 1181 to 1182, there may be a reasonable basis for some type of limited inspection to ensure that the VA IT systems are being used appropriately. But this is too broad. And they said in response, no, it's been in place since 1994. And anyway, this is part of the security requirements to which we have to adhere without citing any specific security requirements. We're going to leave it as is. So yes, we said that and they refused. You know, we have something in the trial court called meet and confer. You really haven't had a meet and confer with the other side over this. You really haven't said, we'll back off if you'll add this or if you'll add a slight condition on the front end then we can resolve this. That discussion, the negotiation. Just tell them the government doesn't negotiate. He's not aware of this. I mean, I'm sure he would love it. He would love to sit down and negotiate. That's not the way the government works. In our experience, the way that this back and forth takes place in these types of proceedings is you submit comments in response to the proposed rule. Hopefully the government takes them seriously. Unfortunately, in our view, they did not in this case. So again, I'll try to be brief here. First, scope. The government's counsel has confirmed that the scope of this provision is exactly as broad as we're concerned about. It was not justified by any risk assessment. I think that has become clear throughout the course of the argument. I think the closest my friend came was mentioning a part of this OMB guidance that mentioned other categories of individuals besides employees and contractors like temporary and seasonal employees, for example. What it says is applicability to those types of individuals is, quote, an agency-based risk decision. So they would have needed to do some sort of risk determination that they needed to impose all these requirements on mere users of the systems. Chief Judge Moore, you ask about explicit statutory authorization. There is none. My friend pointed to various provisions that at a very high level give the VA the authority to promulgate regulations that apply to their IT systems. There is nothing saying that they get to come into your house if you're accessing the VBMS from your home office. See, I don't agree. I think that those regulations could authorize them to, but only if the VA, because what their rule is is quite extraordinary in its breadth, and it's possible if they could have articulated a reasoned basis for needing that breadth. I mean, what is your response to that? If I think under the statute, like, for example, suppose that they had 20 cases where something was going on at the house and it showed that it created a real security risk, whatever, and they're like, this is why we need this rule. We need it because boom. You know, they just didn't do that. That's part of the problem. But do you still win, or do they need to be able to articulate a reasoned basis for the breadth of this rule? Because the statute is super broad. Do what you need to to protect the cybersecurity. That's basically what it says. So yes, we still win because regardless of whether a reasoned basis could have been supplied, it was not here. I don't know if no one could be supplied for the breadth of this rule, but... That was the second point I was going to make, which is I don't think such a basis would exist. But as far as the statute... But I do think the statute, though, authorizes them to do whatever they can provide a reasoned basis for needing to do to protect the cybersecurity. Respectfully, Your Honor, I disagree. And I think this is the point of the major questions cases. I understand from Your Honor's comments, you don't like that argument. However, I think the point of those cases is that if an agency is going to rely on general grants of authority to regulate within their bailiwick to exercise extraordinarily broad power that goes beyond the type of thing they typically do, you need to have clear congressional authorization. The VA is not in the business of knocking down doors and coming in and searching homes where veteran representatives are. I think that that power would have to be justified by very clear statutory authorization. Just to be clear, so I understand your position, it's that there might be a reasoned basis for some narrow subset within the rule, but there's no reasoned basis for the breadth of the rule. I agree with that. Okay, I just... Yes, yes. Okay, are you good? I'll make one final point, if Your Honor doesn't mind. My friend represented that no inspection has ever occurred. We have no way to verify that, but if that's true, then I would ask, why on earth is this necessary? Okay. Thank you, Your Honor. That's a lovely little ending. Thank both counsel. The case is taken for submission. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/argument%3A96046. Public record. Not legal advice.