Oral argument — Grand Trunk Corporation v. TSA

Good morning, everyone. We have six cases on the Court's argument calendar this morning, and we'll begin with Appeals 24-2109 and 24-2156, Grand Trunk Corporation and others v. TSA. Mr. Brogy, nice to see you. May it please the Court, Jeremy Brogy with Petitioners Grand Trunk and Illinois Central Railroad. Congress authorized TSA to skip notice and comment rulemaking only in an emergency, but in this case, TSA has repeatedly invoked its emergency authority to release and then constantly re-release for years a slow-rolling cybersecurity regulatory regime. This highly prescriptive, detailed program would be more comfortable in the Code of Federal that there was any cybersecurity emergency, let alone a cybersecurity emergency affecting freight rail. Mr. Brogy, I note that the word emergency appears in the heading of Section 14.L.2, but it doesn't appear in the text, right? In fact, the text kind of sets out what the administrator actually has to determine. That is, must be issued immediately in order to protect transportation security. Aside from that title, and we can debate, you know, what way we should give it, if any, is there anything about the text of the provision that would support your claim that this is only in case of, quote-unquote, emergencies? Well, the first thing I would say about that, Your Honor, is that the government agrees with us that an emergency is required. So, you'll see that in their brief at page 24. But it doesn't really matter to us what the government says, because we're trying to interpret the statute, right? And so, and I'll ask the government the same thing, but my question to you is, where does the sense of emergency come from? Well, it does come in part from the heading, Your Honor. The heading is part of the text that Congress enacted that is not added later by the codifiers. It's in the session law. But you also see other statutory indicia, including the phrase, must be issued immediately. Must and immediately both connote necessity and extreme urgency, which are hallmarks of an emergency. You see the presumptive expiration, which shows you that this is not for permanent regulation. It's for temporary emergency regulation. And you also just have the structure of the statute, which says that, in general, L1, and that gives regular rulemaking authority, and then L2 is titled emergency. If everything was an emergency, then TSA would never have to go through rulemaking, and that can't be the proper reading of the statute. Would a continuous threat that was unknown and yet suddenly discovered be considered an emergency? I think if it were suddenly discovered, I think it could be, Your Honor. But I would also point out that here, like, you don't really even have to get into precisely delineating the difference between an emergency and a threat, because the government's never claimed there was an emergency. Well, what about, let's say that you have, I'm just trying to figure out kind of the contours of your argument. Let's say you have a dam, right? And there's slowly a leak that develops in the dam, right? And then all of a sudden, there's a hole in the dam, okay? And so you decide, you know what, I need to patch that hole, right? But the, well, I need to do something with that hole. And that pressure still is there, and that hole is still there. And it hasn't been fixed. And so, day one, would you consider that to be an emergency? Well, I think what you said is very important. You said, all of a sudden, there's a hole there. No, no, no. I'm not saying, all of a sudden, you discovered there's a hole there. So would that constitute an emergency in your definition? Well, I think it would depend in part on how long it would take you to fix the hole. And so I think that's important. But again, I'd point you to the fact that the government here has not said there's an emergency. They said there's a persistent threat, an ongoing threat, an evolving threat. So let's say there's a persistent, ongoing leak, okay, in this dam. And so on day one, you look at it and you say, my gosh, you know, we have to do something about this, right? And then in day 10, right, you look and the leak's still there, right? Do you, so you have a persistence of the threat or the leak, right? And yet, do you think on day one, it was an emergency when it was suddenly discovered, but on day 10, you can just ignore it and take the patch out, take the patch away? No, I don't think that. I don't think that at all. And the, you know, but what I would point out here again is, like, take a look at what they're doing. Like, in that situation, I assume what you would do is you'd go put a patch on the hole. Here, that's not what they're doing. Here, they've implemented, like, an entire regulatory regime of the kind that you would see in the CFR that says, you know, nothing, by the way, no steps that have to be taken immediately. You see, you know, 60 days after it's promulgated, the railroads are supposed to submit a plan, and then TSA has an unlimited time to review that plan. Mr. Brody, at the threshold here, you know, I'm going to ask the government the same question. On November 7th of 2024, there was, Department of Homeland Security put out a notice of proposed rulemaking, and the comment deadline is February 5th of 2025. Am I right in your view that the content of the proposed rules, if they were ultimately adopted, would cover the waterfront of the content of the security directives? You're only challenging the one, as I understand, from July of 2024. But to my eye, it seems like this proposed rulemaking would put into the CFR the content going back to 2022 when they started the kind of the installments, or as you were referring to them. Yeah, the rulemaking is broader than this security directive. There are, I think, four different series of security directives. Each series has five or six that have been issued under that series. Yeah. The rulemaking covers all the series. So the comment period will close, but there's no way of knowing when, if at all, the agency will act, right, after the comment period closes? Yeah, that's exactly right. I mean, we think the rulemaking is a step in the right direction, obviously, but it doesn't change the security directive that is regulating us now. And I would just... If the rule, I don't know any more than you would know on this, but if the proposed rulemaking were to become federal regulations, what would your position be at that point with respect to the dispute before us, disputes before us? Is the case mooted? If it became law, like if the rulemaking were adopted, like... Adopted, put in, you know... Yes. Yeah, that would move the security directive. They would presumably take it away at that point. Yeah. And I'm not suggesting that this is around the corner or anything like that. I mean, we're not even to February 5th. Right. And we have a change of administration coming, too. That's right. And I would just point out that the D.C. Circuit confronted, you know, exactly the situation in the Mack trucks case that we cite in our brief. What they said is, they said, we strongly reject EPA's claim that the challenged errors are harmless simply because of dependency of a properly noticed final rule. Were that true, agencies would have no use for the APA when promulgating any interim rules. Yeah. So long as the agency eventually opened a final rule for comment, every error in every interim rule, no matter how egregious, could be excused as harmless error. Yeah. I don't think there's... There's no question we have a case for controversy. Your clients are directly regulated. You know, it's right. There's all of it. I get it. I agree. Can I... Would you mind if I ask you, there was a lot of... And we may be expanding the time here. OK. So you'll get rebuttal time. Don't worry about that. There was a lot of back and forth that the court received in the course of the briefing about the filing of the appendices. One of those appendices, as you both know, is classified. It contains classified content. And that's been made available to us, and we've had an opportunity to review it. But when I read, and there was a lot of bickering about this, and I'm not saying that to criticize, what I'm saying is, is any of that relevant in the presentation of the arguments before us today? Because I don't read your brief to in any way be focused on that, nor for that matter, do I read the government to be focused on it. No, Your Honor. We don't think it's relevant. I mean, that material would at most go to, you know, the existence of an emergency, which we're not asking you to decide. We're asking this court to decide, does the statute require the government to show that there's an emergency? And they've not even tried to do that. OK. So you're not arguing. I didn't see it in your brief. You're not trying to suggest to us between the lines or something that there is procedural irregularity with respect to the record before us or the way the record has been handled? Well, I would say that the things that the government is citing that were, that are not referenced in the order itself are not things that you should consider, and that's Chenery, the Chenery Doctrine, so they can rely on what they said at the time. It is difficult here. I will say this, in fairness to some of the material, it is hard to know what constitutes the record. That's not the easiest feat here. So go ahead. I understand your position. Yeah. No, that's our position is that you shouldn't look at that extra material. I mean, in addition just to the relevance point, you know, just say fairness, like they haven't shown it to us. The norm is public argument, and, you know, we've not seen any of that. But to your point, I don't think it's relevant. Mr. Brogy, how much deference do we owe the agency's determination of what is an emergency? We've got a relatively broadly worded regulation here, and, I mean, what role is it for judges to determine whether or not there's an emergency or not? We don't have the expertise as the agency has. What deference do we afford the agency in these circumstances? Well, as to whether the statute requires an emergency, no deference. Yeah, that's different. But what constitutes an emergency? On the question of what constitutes an emergency, which is not a... Even if we define the word, even if we say this is an emergency, why should it be three judges deciding this is or isn't an emergency, and what deference do we owe the agency's determination? In particular, when you're talking about things like national security. Yeah. To be clear, that's not our argument here. We're not saying that what they said about an emergency was wrong. Our point is that they've never said that there was an emergency, and if you look at the directive itself, it does represent that there is one. Yeah, I'm not sure that they would agree with that characterization, though, okay? I'm not sure that they would agree. To your question, like, on the standard of review, if what we were asserting is have they properly judged an emergency, that would be arbitrary and can purchase review. Would you mind if I ask you about the cost-benefit issue? Yeah. Do you have any other points on those first couple that you want to make? No, I'm happy to go to cost-benefit. Okay. Here's what's on my mind with cost-benefit. When we all know that it's L3, right, where that's where our focus is, but we read L3 against the backdrop of the entire statute, and one thing that stands out to me is when you look at L2, okay? You know, you probably could recite it verbatim, but when you look at L2, you see that Congress authorized emergency procedures in the form of the agency responding with a regulation or security directive, right? When you get down to L3, the factors to consider in the cost-benefit analysis, costs of the regulation with no reference to security directives. Yeah. Well, again, I would point out, you know, the government didn't make this argument, so we think it's waived, but. Well, we have to interpret the statute, and I think, is it possible that that's deliberate and intentional on Congress's part? And I think, yes, it very well could be, because in the event that TSA were to have to respond to an emergency, the speed with which it needs to act, may not be conducive to the conduct of at least what you would traditionally think of as a cost-benefit analysis, so that may explain the absence of a reference to a security directive in Paragraph 3. Well, what I would say about that is, first of all, just pointing at the text, like the heading is regulations. Like, does this belong, this reference to security directives is in 114L, which is about regulations. We think security directives are regulations. We also see in L3, they say, in determining whether to issue, rescind, or revise a regulation under this section, if they'd wanted to limit it, they could have very easily said under L1, but they didn't. They said under this section, and this is indisputably issued under this section. And then, I think as for why they used the word security directives, if you look at the 9-11 report, which Congress had in front of it when it was drafting this statute, it talks about the FAA at that time issuing security directives. Those are not something that's authorized by statute. It's something that the agency had decided to do on its own, but Congress was recognizing that it's doing that, and it's using inclusive language. If you're right in your construction of it, do you agree that acting on an emergency basis does require some speed and dispatch? I agree with that, and I would point out two things. One is at page 32 of their brief, they cite examples of emergency regulations, and if you look, one is the flight deck regulation, and the other one is the- Accompanied by cost-benefit analysis. Accompanied by cost-benefit analysis, yeah. My question is, could the cost-benefit analysis be commensurate with the speed with which the agency has to act? In other words, if we went through notice and comment rulemaking, it may be a much more robust cost-benefit analysis, but we don't have that kind of time here, but we have considered costs and benefits. Exactly right, Your Honor, and again, I point you to the text. It says, whether the costs of the regulation are excessive in relation to the enhancement of security the regulation will provide. So that's a little bit coarser than a typical cost-benefit analysis that you would see done in a rulemaking. And so at this kind of cost-benefit analysis, they could do on an emergency basis, especially if the security directive were actually tailored to a specific problem they were trying to address and not a 50-point plan and a triennial audit, which, of course, it's more difficult to do. Yeah, I mean, to me, it's hard to extrapolate the meaning of cost-benefit from 2A means something different than 3. I mean, what looks like, what appears to me in 3 is a definition of cost-benefit analysis, and it's hard to differentiate between those two things, at least to me. But let me ask you a question. I didn't see this argument in your brief, but the word final determination appears in paragraph 3 under factors to consider under the section of the administration I'll consider as a factor in the final determination. Does that have anything to do with 2B? In other words, could it be the regulatory scheme, and maybe this is just wrong, but could it be the regulatory scheme that 2A says notwithstanding any provision of law or executive order, which we could include a cost-benefit analysis, you can immediately issue the regulation or security directive. But before the Transportation Security Oversight Board affirms the security directive or the regulation, there must be some cost-benefit analysis done. In other words, is that the final determination for the security directive? That, you know, I'll be honest, it's not something I've thought about. That does sound plausible to me. Here, it wouldn't matter because the agency didn't do it then, but, you know, that would potentially be false. I mean, I guess it seems strange to me that there would be this scheme that says, you know, we've got this, I think this is 1993 executive order, right, that says there always has to be a cost-benefit analysis. And then we say, well, if there's a security directive or a regulation that's issued as an emergency that can last 20 years, which is possible, right? I mean, if COVID was an emergency, it lasted three years. There's no need to conduct a cost-benefit analysis ever. I agree. And I think that's why Congress told them that even in the emergency situation, they're supposed to do it. Mr. Brookie, along those lines, kind of jumping off from where Judges Kirsch and Scudder started, looking at L2A, right, the notwithstanding clause, notwithstanding any other provision of law or executive order, I believe in your briefs, Petitioner construes that to only mean laws or orders that require notice and comment, and at least that's how I read it, and yet that clause seems broad enough to encompass the requirements of L3, even if your interpretation is right. And so can you explain to me why the notwithstanding clause doesn't give the administrator the authority in terms, in times of, we'll say for now, emergency to issue a regulation security directive without cost-benefit? Yes, Your Honor, it's a long sentence, but I draw your attention to the last clause of 2A, where it's, so this is, you're notwithstanding any other provision of law at the beginning, and you get down to the last clause, the administrator shall issue the regulation or security directive without providing notice or an opportunity for comment, and without prior approval of the secretary. It doesn't say without cost-benefit analysis. But the notwithstanding clause includes, as Judge Kirsch noted, the concept of a cost-benefit, right, executive order, including an executive order requiring a cost-benefit analysis. It doesn't say, I think that kind of makes me think that the notwithstanding clause is broader than just requirements of notice and comment. Well, that's the government's argument, but. And so I'm just trying to figure out what is that, why would that be included, including an executive order requiring a cost-benefit analysis if the notwithstanding clause is only talking about requirements for notice and comment? The reason that's there, Your Honor, is because there's been a series of executive orders since the 90s that have told agencies to do cost-benefit analysis even when it's not in the statute, and what those orders say is that generally the way you should do it is through notice and comment. In other words, you should take notice and comment so you have inputs about the cost. So Congress has that in mind. They're saying even though that is there as a requirement on agencies that the President puts on generally, you can still skip notice and comment rulemaking. So your reading is that including an executive order requiring cost-benefit analysis is equivalent to including an executive order requiring notice and comment. Well, I mean, I think that there, like, yes, but if you look at the cost-benefit analysis order which we cite in our, or executive order which we cite in our brief, you will see that it says that the way to do it is through notice and comment. So that's what I think Congress is referring to there. Okay. I know I'm long overdue. No, you're overdue because we're asking you questions. So we're going to give you your rebuttal time and let's hear from the government. Good morning, and may it please the court, Ashley Chung-Honald for the United States. In response to the terrorist attack of September 11th, Congress enacted a series of statutes to strengthen national security. One of those statutes created TSA and gave it broad authority to ensure transportation security. In recent years, cyber criminals and hostile foreign actors have repeatedly launched cyber attacks on critical infrastructure, including railroads. In response to these urgent threats to national security, TSA issued an emergency security directive requiring certain freight railroads to implement baseline cyber security measures to protect against cyber attacks and disruptions to critical supply chains. Can I ask you, what are the parameters of what is an emergency? You know, an emergency, I guess, is an emergency whatever the government says it is. How do we, you know, how do we put some guideposts on sort of what is an emergency? Because it seems like in the national security context, anything can be an emergency. I have two responses to that, Your Honor. The first is that Congress delineated in the statute what constitutes an emergency. Congress. And it says immediate. That seems at least to me to inform what is an emergency, an immediate need. Like we have actionable intelligence, and therefore we need to immediately issue a security directive. But what about cyber security has been an issue, I think, since what, I don't know, 1995? Maybe that's not, maybe that's an exaggeration, but it's been an issue for a long time. Sure. So two responses to that, Your Honor. The statute does make clear that TSA can use this emergency authority once the administrator of TSA determines that a regulation or security directive must be issued immediately in order to protect transportation security. So that's what Congress thinks an emergency means. And then TSA made clear in this security directive that even though cyber threats generally may have been something that they knew about for a long time, that this security directive relied on recent and involving intelligence that intensified the urgency of implementing the requirements of this security directive now. So Congress looked at what's in the classified volume of the administrative record and the SSI, that's the sensitive security information, and the public volume. And TSA looked at all of this recent intelligence and determined that they needed to act immediately, that there was an urgent threat now. Does immediate inform at all the breadth of the regulation, the scope of the regulation? I think that. Does that make sense? I mean, if you get actionable intelligence that some event was going to happen at O'Hare Airport within the next 30 days, okay, there would be a security directive because there would, let's say, I'm just making this up, right? There's an immediate need for a security directive. Would the scope of that security directive, would we look at the scope of the security directive? In other words, if the actionable intelligence was specific to O'Hare Airport, could TSA under this statute issue a security directive that affects all airports in the United States? I would push back a bit on the premise of the question, Your Honor. For there to be actionable intelligence, there doesn't need to be intelligence that shows there will be an attack on a specific airport or transportation company on a specific date. But then what's immediate about it? I mean, is immediate whatever TSA says it is? So in this circumstance, TSA is using its expertise in national security to make predictive judgments. So it's looking at the intelligence, again, in the classified volume of the record and the public record, and it's determining whether it has time to go through a formal notice in common rulemaking, which, you know, as we noted in our brief, can take sometimes five years, or if it needs to act immediately to protect transportation security. And when TSA makes these predictive judgments, courts have said that they defer to the expertise of the agency, and these are often conclusions that are based on informed judgments and assessing risks rather than confident evidence. Immediate means something different to the government than it means to everyone else. I mean, the government never acts immediately, or almost never acts immediately. I suppose law enforcement acts immediately when they need to. But short of that, it's, you know, and I just wonder what immediate means in this context. The government can tell you we acted immediately, and it only took us eight months to get this project started, but we did it immediately. I think immediately can mean slightly different things in different contexts. So you can imagine an emergency like 9-11, where within an hour of the first plane striking the World Trade Center, FAA had grounded all aircrafts in U.S. airspace. And they had to act really quickly, within an hour. There was no time for notice and comment, for cost-benefit analysis, or writing kind of a long write-up of the reasons. They had to act really fast. I thought part of the point you were making was it's not just what is it that TSA is responding to in terms of cyber risk and the acuity of cyber risk, the urgency of it. I thought the point you were making as well was there is immediate action needed in the form of the response of critical infrastructure providers, critical infrastructure components of the United States. So one of the aspects of the security directive, as I understood it, was to promptly require railroads to start beginning to take, with dispatch, certain steps to drive down, to enhance their cyber resiliency or to drive down cyber risk, however you want to say that. So it's a two-fold consideration, is what's prompting the government to act, and then how quickly do we need the private sector to act? Yes, that's exactly right, Your Honor, and the TSA administrator made the determination that there was enough intelligence in the record to constitute an emergency and to require immediate action, and it issued this security directive with particular outcomes that it requires certain freight railroads to meet, and it doesn't. So if you think about a very different context, for example, economic sanctions, there are some emergencies that were declared in 1995 that still provide the basis for very robust economic sanctions programs in the United States, right? So there can be all kinds of, that's under the IEPA statute, under the National Emergencies Act, there are emergencies of enduring duration, depending upon what it is that the United States is responding to, the nuclear threat from Iran, for example. So in the national security space, there's breadth to that concept. That's right, Your Honor. As we noted in our brief, there are many examples of emergencies that have been long-lasting, and the fact that this emergency here has been in place for a few years since October 2022 when the first security directive was issued, so just over two years, that doesn't mean it's not an emergency. Can you help us on what constitutes the record, you know, quote, unquote, in this matter? Yes, Your Honor. So the court is reviewing the TSA security directive as ratified by the TSOB. So the record is anything that was before the decision makers, so the administrator and the TSOB, when they made these decisions. And the certified index of record here for both the public volume. Say that again, the certified what? Certified index of record. Okay. So there were government officials who certified that what the government submitted in the public volume, in the classified volume, and in the SSI, sensitive security information volumes of the record, that they certified that these were all materials before the agency decision maker. So that's the administrator of TSA and the TSOB, the oversight board, that these materials were before these officials when they made their decision. And the presumption of regularity applies here. So petitioners seem to suggest that the government has somehow put information in the record that was not actually before the decision makers at the time of the decision. But that's a baseless accusation, and this court rejected that accusation in granting the government's motion to file the classified volume of the record under seal and ex parte. And this court should reject that baseless accusation again here. The, I think the difficulty I have with that broad argument is that the security directives themselves don't even obliquely note that the government, when it considered these risks, is also considering information that either is confidential or is not available to the public, or that it can't release because of national interest, or what have you. It just has kind of general, you know, statements about recent intelligence about cyber security risk. Doesn't the government have to be more specific than that in order to provide the public with the notice that, you know, wow, in addition to kind of what's public available, the government also considered these other things as well? And perhaps I missed it, but, you know, looking through everything, I couldn't find a particular place where the government said, oh, and, you know, we also considered, you know, recent reports that we can't make available or something to that effect. Sure. So I have two responses to that, Your Honor. The first is that the language in the security directive does make clear that the agency was looking at recent and evolving intelligence, which intensified the urgency of implementing the security directive, so it does talk about the intelligence. But second, there is no requirement for an agency to cite or describe every document that it relies on in making a decision, and that is especially true here when even the titles of some of the classified documents, the titles are themselves classified. That's why the government filed the certified index of record to the classified volume under seal and ex parte. So there's nothing unusual about the government relying on intelligence in this way. What about my cost-benefit analysis question that I asked of Mr. Brogy? You know, does 2B have any impact on 3? In other words, 3 references final determination as to a regulation or security directive issued under L2, isn't the final determination the approval by the Transportation Security Oversight Board? And wouldn't it make sense that 2A allows a regulation or security directive to be issued without a cost-benefit analysis, but 2B does not? And 3, you know, to further elaborate on 3, 3 does not require, at least to me, the analysis of empirical data, notice a comment on cost-benefit analysis. It just requires consideration of whether the costs of the regulation are excessive in relation to the enhancement of the security the regulation will provide. It doesn't provide any parameters beyond that. So why should the Transportation Security Oversight Board not have to at least consider cost-benefit analysis in approving the security directive or regulation? Sure. I have a few responses to that, Your Honor. Petitioners seem to read the text to require a formal cost-benefit analysis similar to what... So let's say we reject that. It doesn't require a formal cost-benefit analysis. It just requires some consideration of cost-benefits. So even if you were to reject that reading, I think if you look at the plain text of the statute in the notwithstanding clause, it says that notwithstanding any other provision of law and then in the parenthetical, it references an EO requirement of a cost-benefit analysis. I'm with you. So I think any other provision of law includes the requirement in L3, in Section 3, which requires a cost-benefit analysis. I'm with you. As to the initial issuance of the security directive or regulation, but 3 specifically references as a factor in the final determination. The final determination here is the Transportation Security Oversight Board's affirmation, I suppose, of the security directive. I think that's what it is. At least that's what TSA has been relying upon to not issue it for notice and comment over the past several years. I don't totally agree with that reading. In other words, let me ask the question easier. Is it the government's position that when a security directive or regulation is issued under 2A, it can last indefinitely until the emergency? I got that. The emergency could last 25 years, but a cost-benefit analysis is never required at any time because of the provision in 2A. Yes, Your Honor. I think that's what Congress intended. And TSA can issue a security directive which can be in place for 90 days unless it's ratified by the TSOB, in which case there is no statutory limit on how long it can last. But if you look at, you know, under petitioner's reading of the statute, the notwithstanding clause would be entirely superfluous. If Congress intended, sorry, I see that my time is up. May I finish my sentence? Yeah, you can keep going. If Congress intended to only allow TSA to bypass notice and comment, then they would have just included everything after the notwithstanding clause. Is it, I just want to make sure, did TSA conduct a cost-benefit analysis? The premise of all of this is no, they did not. What's the government's view? Nowhere in the brief is there a statement that no, we did not do it because we don't have to. Do you know, did TSA do one or didn't they do one? Whatever, whether it was formal or informal or short or long? So, TSA did not conduct the type of formal cost-benefit analysis that petitioners seem to think is required. Did they conduct any form of cost-benefit analysis? There is information in the record that shows that TSA received some comments about the cost of these security requirements, in particular, the cost of implementing the security directive as to positive train control. And TSA did make some changes to the security directive in response to these comments. Is that in the record? It is in the record. We don't think that TSA was required to do any sort of cost-benefit analysis because that's what Congress said. I hear you on that, but what you just said could be important because the statutory language in three, as you know, is the administrator shall consider. And if there is record evidence that the administrator did consider, it would seem to me that your argument gets stronger, not weaker. That's true, Your Honor, but our argument is that there is no requirement. I understand that. Suppose we don't agree with you. What I'm interested in is where in the record could we find, you know, some corroboration of what you just said, that they did, I think you're right, I think they did receive some comments on cost-benefits, but then they considered them. And the one way you know they considered them is they reacted to them by adjusting the content. I don't have those record sites at hand, Your Honor. I do apologize. You can send us a letter on that if it's available. Yes, Your Honor, we'd be happy to do so. I'd also like to add that in fast-acting emergencies like grounding the flights after 9-11, in that hour where the FAA had to act, there was no time to do any sort of cost-benefit analysis, whether a formal one or a short one. That's your top-line position. We understand it. We get it. Right. I think the legislative history and the conference report suggests this, and Congress intended this fast-track mechanism to make it easier for TSA to act than it would be under the APA. So that includes bypassing notice and comment. Yeah, on the notice and comment, I asked Mr. Brogy, you'll recall, about the notice of proposed rulemaking that's in circulation right now for comment by February 5th. Do you read this? It seems he agreed or he didn't push back too much that this is pretty comprehensive of the content of the security directives, the multiple security directives that have been issued under the emergency authority. Do you agree with that? In other words, what the agency looks like it's doing is trying to take the content of the security directives, put them through notice and comment, and then consider whether to issue them. Yes, I mean, regulations. Yes, I agree that the notice of proposed rulemaking builds upon TSA's previously issued security directives. I don't know that it's like a complete overlap, but I agree that that's the and they seem pretty comprehensive of what it is doing. And if I may, may make one more point about the cost benefit analysis. I just want to point out that petitioners are incorrect when they say that the two emergency regulations that are cited in our brief both contain what petitioners call robust cost benefit analyses. If you look at the first one we cited, this is the security programs for aircrafts, 12,500 pounds or more. There is a heading that says economic analyses, but then it says that the cost benefit analysis has not been conducted because the current security threat requires emergency action. And that's a cost benefit analysis is not required. So I just wanted to clarify the facts in that. Does the government agree with the petitioner that cost benefit analysis or cost benefit consideration applies to security directives as well as regulations? Yes, Your Honor, that the TSA does not really distinguish between regulations and security directives. Why? Why? I mean, Judge Scudery asked a question. I mean, that I gave you a right. I mean, that really surprises me that that's the government's position. But I mean, you're the government, not me. Right. I mean, I what why is your argument that look, guys, three has nothing to do with this case because L3 applies to regulations and not security directives. It says nothing about security directives and they're different. I think it's because in L1, it says that the administrator is authorized to issue, rescind and revise regulations, and then an L2 Congress discusses both regulations or security directives as if they're interchangeable. So I don't think that Congress was necessarily. Distinguishing between security directives and regulations, I think they're synonymous. Why? Why inject security directive into the text of the statute? Why not just continue to go with the title of subsection L? Just continue to. So it's odd to me that Congress would have intended regulation security directive to be synonymous. Most of the time you assume that when they meet, when they use different words, they mean different things. But then they drop it when they get into three. I'm not sure of the answer to that, Your Honor. I think in creating TSA and in issuing this act, Congress was giving broad authority and using belt and suspenders to give TSA broad authority. So the fact that it used these two terms, I don't think necessarily means that there is a difference. I it seems to me that the government, I mean, from what you're saying is the government is concerned that if you distinguish regulation security directive, then the government has no authority to issue security directives because under L1, L1 just gives authorization to issue regulations. But I'm not sure whether given the clear language of L2 that that's necessarily the case. I see your point, Your Honor. I think I think L2 does clearly give TSA. Right. I mean, the administrator's authority not only comes from L1, but L2 gives the administrator independent authority with regard to security directives. I think that's right, Your Honor. I think I think it would shock the administrator of TSA if you told her that she is without authority to issue a security directive at the nation's airport in response to terrorist risk posed by al Qaeda. I think that would be a stunning proposition. Yes, I agree, Your Honor. And if you'd say legally, where does that come from? I think what Judge Lee is suggesting, the text of the statute. Yes, that's correct. Congress gave TSA broad authority to act in response to emergencies. OK, go ahead. Going going back to kind of where we started the immediately. Right. So as I as I kind of understand your argument with regard to cybersecurity threat, I take it your argument is that the risk of cybersecurity threats has been known for some time. But then it reached a point where the administrator decided, you know what, the risk is so great now that we have to act. Right. I mean, that's kind of what you're saying, and that that risk has not gone back down to a level below that line. My question is about standard of review. The statute says immediately, OK, do we owe any deference to the administrator's decision about where that line is, where that line, where immediate action is to be taken is, or do we, based upon the statute, conduct our own independent de novo review of that decision? I think that the case law indicates that there is deference to TSA's expert judgment here. The D.C. Circuit said in cases like Bonacci and Olivares, which we cited in our brief, that courts do not second guess expert agency judgments on potential risks to national security. So I think when TSA made the determination that there was a national security risk and that immediate action needed to be taken, that there is deference afforded to that determination. And so in the government's interpretation, emergency can refer to a longstanding persistent risk that all of a sudden reaches a point, a threshold where the where the administrator believes, OK, we need to act now. Yes, exactly, Your Honor. And just to give one other example, there is kind of an ongoing risk of terrorist attacks. You know, everyone knows this is something that TSA has to take into consideration and defend against. But if recent and involving intelligence showed that there was an elevated risk and TSA needed to act immediately, the statute clearly gives TSA that authority to act immediately to protect transportation security. And I'd point the court to a few examples in the classified SSI and public volumes of the record that really underscore this risk. So on pages 21 and 262 of the supplemental appendix, it discusses examples of attacks to railroads and major cities such as San Francisco and New York by hackers linked to the Chinese government on pages 56 through 59 of the supplemental appendix. This is a joint cybersecurity alert issued by multiple intelligence agencies by NSA, FBI, CISA, and it identifies a specific Russian state sponsored operation called Berserk there that has targeted transportation systems and other critical infrastructure facilities. There are other examples in the classified record, particularly pages AR 762 to 763, also 764. And on page AR 683 of the SSI volume, I think these are just some examples of the urgent national security risk that TSA relied upon. OK, Miss Hall, thank you very much. Thank you. Appreciate it. Mr. Brody, we'll give you your three minutes of rebuttal. It's a few quick points, Your Honor. First of all, with respect to the cost benefit analysis, I'd point the court to Appendix 140, where a TSA senior official replied to the industry, quote, TSA does not do cost benefit analysis for security directives. So that is the agency saying that they did not do one here in the category. Appendix 140. Appendix 140. Yes, Your Honor. I'd also just right there at the end, the government pointed the court to Appendix 262, as we say in our reply brief. That is that's a document they prepared after this litigation began. It's dated July 16th. It's not something this court should look at. Judge Kirsch, you asked about scope of the normal scope of a of a of a security directive. I point you to what the FAA says. This is the 54 Fed Reg 28982. Security directives are used to notify U.S. air carriers of information on specific credible threats that are limited by such factors as location, number or identity of carriers, method of attack or duration of time. FAA also says SDs, quote, distinguish between information that is general in nature and that which has been assessed to require a specific security response. What we have here is not a typical SD in any sense. With respect to immediacy, I would just say if you discover an emergency, you act immediately. This has been going on for years. The government doesn't contest that. The SD acknowledges that. It says ever present, it says persistent, it says ongoing. And nothing it does requires immediate action. All the deadlines in the SD, take a look at them. They're 60 days, 120 days, two years, three years. That's that's not an emergency directive. Finally, I would just. So would your clients prefer if the GSA just requires them to do it in seven days? If it was very narrow and targeted, maybe. But, you know, obviously, we want more time for an expansive regulatory program. Right. Well, I guess what I'm saying is that if. That the administrator believes that the remedy to address alleviate these risks is kind of multifaceted. Right. And required the industry to address it in seven days. I would think that the industry would challenge that decision as arbitrary capricious, because there's no way the industry would have been able to implement those changes in seven days. And so the. My only point is, I think what Judge Kirsch kind of reflected is that the amount of time that the industry is given seems to reflect the type of remedies or type of measures that GSA believes industry should take. Well, look, we appreciate having more time, obviously. So I'm not I'm not I'm not disputing that. But I will say, if you look at the timelines here, you know, in 60 days, give us a plan for what you're going to do in three years. That's not typical emergency regulation of the kind that I just read. It's it sounds like perhaps your argument is that the second prong of the two pronged approach, the immediacy informs or the first prong informs the second prong. In other words, if there's an immediate need, like you described with the FAA, right, certainly the FAA could require immediate action on a part of a carrier right today. You need to act today. But it's it's very narrow. I guess it's I suspect your argument is it's harder for the government to say we've identified an immediate need and you need to fix it in three years. Right. That that that means immediate is whatever the government says it is. And so therefore, prong one informs prong two of a two fold approach. That's right, Your Honor. Lastly, I would just point out you're reviewing the security directive. You know what I hear the government say is that you should look at all the extra materials that cited and then decide for yourself whether there's an emergency. You just need to look at the security directive and what it says. And it does not claim that there's an emergency. The NPRM you asked about, that's very different. Obviously, it includes a lot of these same ideas, you know, but we'll see what that looks like. OK, actually to vacate the security directive. OK, very well. Mr. Brogy, thanks to you and your colleagues, Ms. Honnell, thanks to you and the department as well. We'll take the appeal. The appeal is under advisement.