Oral argument — Spokane Airport Board v. TSA

Case number 23-1155, Spokane Airport Board, Petitioner v. Transportation Security Administration. Mr. McPhee for the Petitioner, Mr. Lewis for the Report. Good morning, counsel. Mr. McPhee, please proceed when you're ready. Thank you. May it please the court, counsel, and those in attendance. My name is Jim McPhee and I represent the Spokane Airport Board. Now this case involves a government agency that tried to amend a regulation not following the correct procedure. Now airport operators aren't guaranteed an outcome, but they are guaranteed a procedure. And when TSA issued JE 23-01, it denied airport operators the statutorily guaranteed procedure of ratification by the Transportation Security Oversight Board, TSOB. Now airport operators are required to airport security programs by regulation, by separate regulation. If I can just ask you a threshold question. Did the Spokane Airport Board raise this statutory question before the agency? Yes, it did. In terms of adding cybersecurity as an additional topic to 49 CFR 1542-103A, is that the question? No, but the argument that an emergency regulation had to be promulgated under 114L2, right? Yes. And so requires approval by the TSOB. Yes. Was that argument raised before? Was that particular issue raised before the agency? Yes, your honor, it was. Can you point me? Yes. In our petition for reconsideration, and that's at JA-144, in two different spots, note one, it states in 49 CFR 1542-103 entitled content, TSA has developed a regulation for what each airport operator regularly serving operations must include in its airport program. That's a reference to, obviously, 1542-103. I'm on the page, but where are you reading from? JA-144. Yeah, I'm on the page. So which paragraph? Note one. Note one. Now, if we go to the same page, JA-144, and we go above in the first paragraph, there's a passage in which Spokane Airport Board says, there is no clear legal or factual basis for TSA to assume regulatory authority over information technology assets of airports. That's a reference to, first in note one, that cybersecurity is not a topic listed in 103-A, and that following that, TSA doesn't have the authority to regulate that absent rulemaking under 114-02. But that, I thought the question was about, although I don't mean to hijack the question from Judge Rao, but I thought the question was about the last strand of the analysis on whether the TSOB needs to be involved in the process. And as to that, I didn't read either the footnote that you identified or the textual sentence that you identified to speak to that question or to fairly raise before the agency whether they needed to go through the TSOB process as if it were an emergency under Section 114. And your honor, I think that goes towards the issue of raising the 103 issue and the fact that they can't regulate cybersecurity. I think inferred in that is the fact that it has to go through a rulemaking process in order to do it. What the Spokane Airport Board had identified is the fact that even if it has to go through a rulemaking process, it just seems like that's several steps down the list. It's sort of like saying, we raised one issue, and then if you follow that issue down the decision tree, seven steps, you'll see that that also would have encompassed that it needed to go before the TSOB. And I'm just not sure that preservation operates in that way, because the reason to have a preservation requirement and exhaustion requirement is so that the agency's put on notice that they need to address an issue. And your honor, I would respectfully argue that when they issue JEA 2301, and the airport operators are given 15 days to draft their petitions for reconsideration, that it could be treated not unlike notice pleadings. I would also point the court to JEA 162. Now, there was a memo that was drafted and given to the administrator of TSA. And another operator argued that TSA must amend its regulations before proposing cybersecurity amendments to aircraft operator standard security programs at JEA 162. So it was something that was raised and it was identified by TSA to the point where it even went in a memo suggesting this is how we're going to respond to it. So I do think it was fairly raised. Yeah. I mean, another question. I mean, we have some cases that suggest that that issue is jurisdictional. The issue, you know, exhaustion provision in the statute is jurisdictional. But the Supreme Court has in a number of recent cases said that an exhaustion provision is only jurisdictional if the provision is very explicit as to its jurisdictional nature. And the government doesn't challenge, doesn't suggest that there was an exhaustion problem here. I would agree with that, Judge. I mean, they suggest there's an exhaustion problem with a number of other arguments, but not the statutory argument. Right. And they raised a number of different issues, which we addressed in the brief as it relates to potential waiver of different issues. But again, I think that note one, right in conjunction with the other provision, fairly preserved it. In addition to the fact that TSA was aware of it as it recognized in its memo that I just referenced to the administrator of TSA. Can you just say again, I'm sorry, on J-162, which particular part of that J-162 you're pointing to to show TSA's recognition? Yes, Your Honor. And actually, if I could grab my Your Honor, in J-162, the lowest heading that's underlined says need to amend 49 CFR 144-103C to address cybersecurity. This is the memo to the administrator of the TSA that identifies that cybersecurity must be added by rulemaking, not by ASP amendment. Right. So it goes to that question and that I think footnote one that you pointed to earlier, arguably goes to that question too, but then a follow-on issue about whether the process needed to involve the TSOB in a particular way. I'm not sure that that's flagged. There's a question of whether that's jurisdictional, which is a related issue, but in terms of whether it was preserved, the need to go through the, need to get to the TSA, get the TSAOB's sign off, not in the way that was done, but in a more, in a way that's forecast by the Section 114 provision, that particular part of it. Your Honor, I think it's a guaranteed, it's a guaranteed procedure under statute that if, if TSA is going to invoke and state that there is an emergency, then what TSA has to do is go under 49 USC 114 L2. They can do it without notice of comment, but just by virtue of the required statutory procedure, it requires TSOB ratification. It's just a required part of steps if you're going to add cybersecurity to 103A. They could just do a regulation with notice and comment though. That's correct. If they did, if they did amend it. They have to do a regulation doesn't necessarily encompass that they have to do an emergency procedure with TSOB. You just saying they have to go by regulation could mean they need to have notice and comment. Well, what they would be doing is they've stated that it's an emergency, and as a result, they can forego notice and comment in that emergency, yet it would still have to go through TSOB ratification. I understand that, but that's not what was preserved, is it? I believe that it was, because I believe that the statutory procedure is guaranteed. And once the issue is raised, then the guaranteed statutory procedure has to be followed. So we're, we're required to have to, our airport security programs are required by separate regulation to have 21 specific topics, but one of those topics is not cybersecurity. Now, looking at footnote one on page 144, it says that the process followed without notice and comment. It's legally deficient and it shows callous disregard for the value to be provided by comments from airport operators and aircraft operators and review of the same by TSA. So it doesn't seem to be saying if you're going to do an emergency, we get TSOB. It seems to be saying you needed to get comments because you're disregarding the value of comments. Well, Your Honor, I, Judge, I think that the combination of note one text above coupled with the memo to the administrator of TSA does properly preserve this. And what it does is it triggers a guaranteed statutory procedure, the end of which is TSOB ratification. Now, if TSA wants to amend 103A to add cybersecurity, it has to go through that procedure and it has to get TSOB ratification, but because it didn't, this agency action expired after 90 days. Now, TSA responds by cobbling together patchwork statutes and regulations, you know, for post hoc support for an overbroadened and incorrect assertion that it inherited all of FAA's functions. Now, it's, but they pirouette around the statutes that actually control them. It's right in front of us in black and white. Now, Congress did give FAA emergency rulemaking ability without notice and comment. But when TSA claims that Congress then transferred that FAA function to TSA, it's incorrect because emergency notice, emergency rulemaking without notice and comment is at 49 USC 46105C. Now, when APSA was enacted, we had 46105, it had subsection A, ordinary rulemaking, and subsection C, emergency rulemaking, both listed FAA. But when APSA was enacted, TSA was added to ordinary rulemaking in subsection A. It was not added to emergency rulemaking. That was retained exclusively by FAA. My question is, does that matter? Because the grandfathering provision 141F says that the TSA will exercise all authorities under any other provision of law that were available with respect to the performance of the function to the performance immediately before the effective date. And that provision, that savings provision, and that any portion of the savings provision, but that specific portion of the savings provision doesn't help TSA at all. Because as you just stated, that savings provision allows TSA to perform functions that were available to FAA, both before and after ATSA, and to this day, 46105. As of the date, so if FAA could do it before it was transitioned to TSA, why can't TSA still do it, even if things changed after? Well, Judge, my reading of that is they were transferred things that were available to FAA. But 46105, emergency rulemaking without notice in common, is available to FAA to this day. And in addition, the savings provision gave TSA functions that were transferred by ATSA. But as I just mentioned, when ATSA was enacted in 2001- I understand your argument. It's just not clear to me that this provision doesn't allow TSA to exercise those functions anyway. Because it says that if they were available immediately before the effective date, TSA can do it. So even if you change it after, it's not clear to me why they can't still perform those functions that existed before. But our reading of that statute is that if the functions were available, meaning that they were transferred to TSA and ATSA, then TSA can perform them. But these were not transferred in ATSA. The 46105C, emergency rulemaking without notice in common, was before and after ATSA, and to this day, retained exclusively by FAA. And the savings provision also doesn't help, because when TSA cited its authority for JEA-2301, it didn't cite the savings provision. It cited 49CFR-1542-105D. And 105D doesn't cite the savings provision. And so where does that take you? So suppose the legacy FAA authority isn't what's at issue, and that let's just, I know the government will resist this, but just for purposes of understanding where your argument goes, if that wasn't or couldn't be what was exercised here, then what? If you could clarify, Chief, if what was an event? If the FAA, if the legacy FAA authority isn't what was being exercised. I think it's, if I'm understanding all the numbers being banded about it, I confess that I'm not I'm sure that I am, but if I'm understanding all the places that are being banded about, I thought what the exchanges you were having with Judge Pam was about whether the carryover FAA authority was what was being used to promulgate the 2301. No, the 46-105C, which is FAA's emergency rulemaking without notice in common, wasn't referenced in JEA 2301. And again, that wasn't, that wasn't, that was retained at all times with the FAA. Now, if you, if you're talking about emergency. Yes. So I guess I think that's, I think we're saying the same thing, I believe, which is that, so the government relies on the FAA authority, but you're saying that wasn't relied on and it can't be relied on, right? Correct. If you're talking about emergency rulemaking, FAA gets to do it without notice in common under 46-105C, but TSA needs to do it under 49 U.S.C. 114L2, and it requires TSOB ratification, which makes complete sense because FAA had been doing emergency rulemaking without notice in common since 1958. And in 2001... I guess what I'm asking is, is the consequence, if we, if we worked hypothetically to agree with you that the agency didn't or couldn't rely on the FAA provision, but had to go under the TSA provision, what's the upshot of that for you? Is it that then the joint EA couldn't be sustained because the TSOB ratification was not obtained? Is that the upshot? Yes. And what's interesting is because, and important to note, is the fact that had TSA done this correctly, that TSOB wouldn't necessarily be looking at JEA 2301, because to do this correctly, you'd have to add cybersecurity to 49 CFR 1542-103A. It's a 20-second topic. Okay. So had this been done... Then on that, suppose we disagree with you on that. Suppose we think that for purposes of the regulation, and I'm just speaking for myself here just to play out the decision For purposes of the regulation, let's suppose we think that 23-01 didn't need to be an amendment to the regulation you just identified that spells out what needs to be in the security program, and it could still be good. Then what? Does that mean, then did it, if we think it's consistent with the regulation, and does that mean then that the TSOB ratification requirement that you otherwise think would be operative then drops out of the equation? So as the chief judge is your question, that this JEA 2301 truly was only an ASP amendment and was not rulemaking in any way? Right. It was a valid regulation? Exactly. It was a valid... Let's just suppose we think it was a valid ASP amendment. Then TSOB ratification would not be required because under that hypothetical, then 103A, it wouldn't be rulemaking and changing the regulation under 103A. We'd have to ignore the fact that TSA is trying to add an additional regulation, an additional topic to that regulation, and if we can suspend belief and say that that's true, then they could have proceeded without TSOB ratification. And 103A is what? What's the full type of that? 49 USC... I mean, sorry. 49 CFR 1542-103C. Got it. Got it. Okay. Thank you. Yeah. So in your view, if we think that JEA... So many numbers. JEA 23-01 could be an amendment for purposes of the regulation, you resist that. But if we thought that, then your objection as to TSOB ratification drops out. Yes. But our objections with regard to being able to show prejudice and being able to show that this agency action was arbitrary and capricious stand, both of which are justified by the failure to follow the requisite procedure, as well as the additional points that we raised about, for in one spot, which is a risk to cybersecurity. I mean, if you're going to take all of these airport security programs or the sensitive cybersecurity information and put them in one spot, it's not only a risk, it's a challenge to cyber terrorists. Put them in one safe, so you have one lock to pick instead of dozens of safes. I'm interested in your response to the TSA's argument that they have been basically exercising this kind of legacy FAA emergency authority since really the agency was created and they've never even convened the TSOB for the purpose of ratifying an emergency regulation. What should we make of that? I mean, how should we understand that argument? This is a longstanding and contemporary understanding of the TSA. Whereas maybe the first example might date back a ways, it is not longstanding. It's not ongoing. It's not enough to excuse TSA of the requirement to follow the statutory procedure. Were these instances emergencies? And in fact, were these instances circumstances where TSA just got it wrong and it wasn't challenged? I mean, I don't know that, but what I do know is that there is a statutory framework and a guaranteed procedure. Again, airport operators not being guaranteed an outcome, but being guaranteed a procedure that wasn't followed. It wasn't followed there. Has your client been subject to other emergency regulation type procedures that followed the procedure that was followed here? Something separate and apart from JEA 2301? Yes. I'm just wondering how often this happens. I'm not aware of any off the top of my head in terms of a joint emergency amendment. There was a national amendment, August 11, 2022, that TSA put out with regard to cybersecurity, but that went through a round of notice and comment. And when the second round of notice and comment was coming up, that's when JEA 2301 was issued. So this is the first instance that you're aware of where the TSA followed this procedure to implement what is essentially a regulation? I'm hesitantly answering yes. My colleagues don't have additional questions. We'll give you a little time for rebuttal. Thank you very much. Mr. Lewis? Ben Lewis for the government. As the case comes to this court, there was no dispute that there was an emergency in the aviation sector that the TSA needed to address. Foreign states, other proxies, and cybercriminals had repeatedly conducted cyberattacks on the aviation sector, and TSA had identified cybersecurity vulnerabilities in airports that called for an urgent response. So accordingly, TSA issued an emergency amendment to airport security programs. So why did TSA do that instead of following the procedure in 114-02? So I think it would be useful to walk through exactly what the government relied on and what TSA understands itself to rely on. So the substantive authority that, and the reason why it went through the regulations is because for airport security programs in the aviation sector, it typically exercises this kind of emergency authority. The reason why, or sorry, emergency amendments for airport security programs. Have they done this before for a regulation type amendment? Yes. So there are dozens of emergency amendments, both on airports and aircraft that amend their security programs and go through the procedures of section 105D. The reason why they did that- Can I just clarify, when you say there are dozens, it strikes me that this often would apply in an individual basis. Like- Yes, I mean- TSA identifies a particular airport, you need to fix this. But you're saying there are dozens that were regulation type things that applied to a vast swath of airports. Dozens that are broad-based, that are not within the existing categories of subject matter. And that's because TSA is at the front line of these emergencies that arise from time to time. If you refer to the 1972 advisory circular that accompanied the initial regulations, they're quite directive and they're quite specific about the kind of substantive requirements that airports need to follow. If you follow that through to the other authorities we've referenced in 1985, when there were airport hijackings, TSA was at the airlines. You follow it through to the 9-11 itself, when there was an emergency amendment that did things that we now take for granted, but did not exist at the time. For example, no longer allowing curbside check-in, requiring passengers to go with a ticket through security screening, requiring that vehicles not be within 300 feet at the time of an airport. All of those things are substantive activities that they pursued through the mechanism of emergency amendments, and the same is true here. But I do think it would be useful to clarify exactly what the government is relying on here, because I don't think the other side gets this exactly right. And so, in November 2001, much of the point of the Aviation and Transportation Security Act was to go very quickly from an agency, an FAA, that had responsibilities over all aspects of administration for the aviation sector, to one that was dedicated to aviation security in particular. And the way that it did it is through primarily this savings provision. So, FAA had long been responsible for airport security programs, and so Section 114 F-11 of ATSA makes clear that it's going to be TSA's function to, quote, oversee the implementation and ensure the adequacy of security measures at airports. FAA had long-standing rules and regulations to carry out that function, and so the congressional judgment at Section 141 B and F of the public law was to say those rules and regulations carry on through according to their wholesale to the TSA. And so, it's those authorities that TSA is relying upon. So, there's no Chenery problem here. When the TSA initially passed these regulations to itself, it cited a broad range of authorities, including 49 U.S.C. 44901. That's where this public law is codified. It's a note to that section. Where is that? Where did it cite that provision? So, the other side references the regulations that carried out the administrative action of taking the regulations from FAA to TSA. The authority for Part 107 of this section, or, Part 1542 of this section, in that section, it cites essentially all of the provisions that were passed through, both in Chapter 449 and in the existing regulations. And in that section, I take the other side's argument to be that because TSA cited 114 at that time, that when it exercises that emergency authority, it's going through 114 L-2. That's not the case. It cited that position because it's carrying out the functions that it became responsible for to oversee the adequacy of security measures at airports. Why does the savings provision apply here, though? Because the savings provision has to be for a function that's transferred to TSA. And 46105C, which is the emergency rulemaking, wasn't transferred. Yes. So, the function that TSA is taking on is the function of ensuring the adequacy of security measures at airports. To be clear, the government is not saying that it needs any special rulemaking authority to take an action immediately, and is not relying on 49 U.S.C. 46105 to say that it can take this action because of that provision. Well, I understand that that's not what you're saying, but in order to take the FAA's emergency rulemaking and use that by the TSA, you have to have some underlying statutory provision to that emergency regulatory authority. Anytime an agency has substantive authority, it can decide to take an action in 7 days, in 14 days, or immediately. The disputes in those cases are about procedures. Typically, it's a dispute about whether an agency follows the Administrative Procedure Act, including notice and comment provisions. The other side has been quite clear in page 15 of the reply brief that they are not making an argument anymore that TSA did not go through notice and comment, that they're not relying on that, or making an APA-style argument. I really think the dispute here for the court is, did TSA act appropriately in just following the procedures in 105D, or did it need to take the additional measure of getting TSOB ratification? Congress specifically provided a way for TSA to do emergency rules. It does seem, or I guess my question is, why is it not an end run around that provision to make emergency rules in a different way, other than the way that was described by Congress? Agencies all the time have many different mechanisms to take an action immediately. It can do, as the other side recognizes, an interpretive rule that takes effect immediately. It can do a rule that operates through the good cause exception of the APA, or it can act through- TSA is not relying on those. I think TSA does understand what it is doing here as operating quite similarly to the good cause exception under the APA, but to answer your question, the reason why Congress would set up these two different mechanisms for TSA to operate is that they further different functions of the statutory design. So one half of the purpose of the Aviation and Transportation Security Act was to ensure that there was an agency that was dedicated to aviation security, and at a time of great uncertainty, your weeks and months could take those regulations wholesale. The second half was to ensure that there was an agency that could regulate all aspects, modes of transportation. I mean, I understand how important the TSA is, but how does that relate to rulemaking? It relates to this rulemaking- I don't see the connection. The connections, I think it roughly corresponds to the two functions of these tools for TSA. The reason why Congress gave TSA the 114, this tool in 114, to go through notice and comment is because it wanted to give them a much, much stronger and much, much broader mechanism to effectuate change than had existed before. And so to give a concrete example- Wait, I'm sorry. I thought you said it did exist before because you're relying on the FAA legacy ability to do things with no notice and comment. I'm trying to distinguish between two different tools that are available to TSA here. One is the 105D mechanism. The congressional judgment that TSA is relying upon there to exercise that tool is the public law in ATSA itself, section 141F and 141B. To answer the question of what procedures was TSA required to go through, that congressional judgment that those rules and regulations be made available to TSA governs. There's so many numbers being thrown around here, I'm getting confused. Is that the FAA legacy authority? Legacy, it is the savings provision in ATSA. But the effective savings provision is to allow TSA to rely on what the FAA was relying on. Correct, to do exactly the same thing. I'm just going to call that the FAA. The FAA, but I just want to distinguish that from the section 105 FAA authorities that the other side has been referring to. I thought, what's 105? Sorry, but 1005. 1005. Okay, 49. 49 U.S.C. 46105. Right. The government relied on that provision to make the very narrow point that when these rules and regulations were initially promulgated, Congress understood that the airport security programs would not have to go through notice and comment. It's not relying on that provision to say that anything I think about TSOB ratification, one way or the other. We said that provision, we're not talking about 46105. 49 U.S.C. 46105. Correct. That provision. And then what, 1005, it's not 105. Yes, that's the section 1005 of the FAA Act. The same thing was codified at 49 U.S.C. 49605, I'm sorry. Okay. What does 1005 say? 1005, I'm sorry, 1005 is the existing tool that FAA had to take immediate action in response to an emergency. Without notice and comment. Correct. It is the statutory provision. And then the... Somebody else is referring to that as 1005. Yeah, I apologize for confusing, causing confusion. And on, let's call it 1005. I thought at one point there was a reference to 1005D, but when I look at 49 U.S.C. 105D, yeah, sorry. Sorry, go ahead. I don't see a 105D. I see 49 U.S.C. 46105 has A, B, and C. They're also a D? Yes. Yes. I mean, maybe I have my, look at these. Yeah, D is emergency amendment. Yes, sorry. It's available. Under 49 U.S.C. 46105. 1542.105D. 1542.105D. Yes. That's the regulation. That's the regulation. Okay. That's what the 105D you're talking about is a regulation. Right. It's a regulation and the congressional judgment that explains why TSA has this regulation available to exercise it is that the savings provision in ASSA. I think... I haven't explained why the savings provision applies here because those functions haven't... I mean, you're just relying on the general functions that are transferred to TSA, but the savings provision seems to be referring to specific authorities that are transferred to TSA. Yes, these specific authorities. I think it's important to recognize that the tools that we're talking about here are quite different in time. The 105D, this emergency... Is there another way I can be helpful to refer to it? 105D is the regulation. Yes, the regulation. It requires... Its amendments take effect only upon notice and there's an administrative back and forth that happens with these petitions for reconsideration. That is not the case when TSA exercises the tool in 114L2. In that circumstance, the rules take effect without notice and there is no opportunity for an administrative back and forth. And so to give an example, on 9-11 itself, there were thousands of airplanes who were in the air. FAA issued an order that grounded them all immediately. That took effect without notice and was enforceable immediately. There was no opportunity for a back and forth. Then in the weeks that followed, the FAA issued an emergency amendment that directed the conditions that were required for airports to reopen. They were collaboratively with airports in order to get them to a place where airports could be made available. I understand that these two provisions operate in a different way, the regulatory authority and the 114L2 authority. They operate differently, but that doesn't answer my question about where the authority comes for TSA to exercise FAA's legacy regulatory authority. We do FAA's, the regulatory authority, we understand that authority to come from the savings provision. Yes, but why? Because that is what Congress said. Congress directed that these, quote, rules and regulations would continue in effect. Regulations, right, but for functions transferred to TSA. Correct. And the function that was transferred to TSA is this responsibility to oversee the adequacy of security measures at airports. Everyone had understood, Congress included, and was specifically aware of at the time. That's the substantive function. The function to make emergency rules was not transferred. And the government does not understand there to be required authority to take an action immediately. When it takes an action immediately, agencies take actions immediately all the time. Wait a minute, though. Are you relying on the FAA legacy regulation as the authority for what you did here, what the agency did here? We're relying on the rules and regulations, and then there's a procedural dispute over whether TSA needed to do more than those procedures and the regulations. Let me ask it another way, because I think I have the same question as Judge Rao. You're relying on the savings provision, and you're saying that the power and authority of FAA to regulate safety and all these things were transferred to TSA. That's substantive authority, yes. And I thought I heard your friend on the other side say that since 1958, FAA was issuing emergency rules with no notice and comment, that that's something that it's allowed to do. Is there a statutory provision that allows it to do that? That allows TSA to- FAA, the legacy provision from 1958, they've been doing this. What's the basis for FAA doing it? Yeah. So, in addition to their ordinary APA tools, I think that they have this specific statutory provision at 49 USC, I believe it's 49605. But isn't there emergency rulemaking authority in 46105C? Yes, it is. Thank you. And that provision, this is what I'm asking, that statutory provision was not transferred to TSA. Correct. 46105A was transferred, but not 46105C. Yes, we don't think TSA needs that authority to have been transferred. And I think it is true that if the other side- It needs that authority to be transferred if you're relying on the savings clause. I don't think that's true. Okay, why? Because the savings clause makes quite clear that TSA has the substantive authority to issue amendments to security programs. And there is no special authority that is required for it to take that action immediately or to do so in the procedures that are outlined in 105D. There may be, in many cases, procedural disputes or issues or arguments that can be made. But I don't understand the other side to be making an argument that TSA, kind of this whole system of airport security programs, that they lack the authority to issue amendments. And if they were making that argument, I think that is an argument that they would have to be presenting to the agency in the first instance, because that would be an argument that what TSA did here, the emergency amendment it took, was not authorized. Let me ask you about that, because the government here says that a number of issues were not But it does not argue in its brief that the statutory argument was exhausted. In fact, it provides a lengthy rebuttal in the record. Yes, the reason why I did that is because the regulated entity is informed of whether or not it goes through TSRB ratification at the time that it receives the denial of the petition for reconsideration. Has the government waived any objection to issue exhaustion? We haven't taken a position. And if this court, you know, understands it to be jurisdictional, it would, you know, have to analyze it. If it's jurisdictional, of course, you can't waive it. But if it's not jurisdictional, then it does seem to be waived. I'm not trying to affirmatively waive it here at the podium, and we haven't taken a position on that question. I think there is a conceivable world where this court But you haven't argued issue exhaustion on the statutory question at all. Correct. So you have forfeited or waived it. We don't take a position on that question. And the reason I think is because they received that notification about whether or not it goes to the TSRB ratification process at the time of the denial. But if I could give maybe I don't understand that. Why would that be a reason not to raise? So the opportunity for them to raise an argument with the agency is through this post-issuance administrative petition for reconsideration. And at that time, it's a 14-day period. There's a 30-day period for TSA to go through the TSRB. So at the time that they're filing their petition for reconsideration, they don't know yet whether the TSRB has ratified it or not. So it's true here that TSA, when it issued joint EA 2301, that it noted the authority it was relying on was the regulations. So I think these sophisticated entities would know that it was not probably going to go through TSRB ratification, as that has been the long-standing practice for the agency not to do so. But we didn't formally take a position on that in our briefs. And I'm not trying to spin out a new argument here at the podium. But suppose we take note of the fact that the regulated entity didn't object to the agency, that the agency failed to get TSRB ratification. Do you think that would be wrong to care about that? I think, I guess it depends on the form that their argument is taking. I think it matters a great deal. If they are kind of making the argument here that TSA lacks the authority to issue an emergency amendment immediately through the procedures of 105C. If that's the argument they're making, then they do need to present that to an agency in the ordinary course. Because as soon as they know that they're issuing an emergency amendment under that regulation, then they're on notice that they should be making an argument that the agency lacks authority. If they're making what I had understood their argument to be that in addition to the procedures and the issuance of the emergency amendment, TSA needed to then get it ratified by the TSOB, I think that type of argument, it's fair for them to raise, you know, in the first instance, in a petition for review, because they don't have that opportunity to know either way until the petition for reconsideration is denied. But if I could maybe give an off-ramp to the TSOB issue, just I think that has come up here today. The other side does seem to clearly concede that if the regulations, sorry, if the emergency amendment was within the regulatory authority, and it's not, does not require an actual published amendment to the regulations, then it would not need to go through TSOB ratification. I think you can take the parties, you know, arguments on their terms. And there are a couple of clear reasons why I think this is an amendment and not a regulation. One is... Can I just, before you go there, because I do want to hear that. Yeah. But on the predicate to that, which is that if it is an amendment, then TSOB ratification drops out of the equation. Do you agree with that? I agree. What you're saying is that they've conceded that. Yes. And I'm wondering, does the government agree that that was right to concede that? Sorry, can you reframe the question so I have it right? Yeah, and tell me if I'm asking the wrong question. But what I understood you to be saying is that the other side concedes, and we heard what the exchange earlier, that if JEA, whatever the number is, the one we have before, if that one was within the amendment power under the regulative 105D, then there's no available objection that the process needed to include a TSOB ratification that wasn't done. So I think, you know, there are a lot of premises baked into, I think, that concession. And I think it is appropriate to take their argument on its terms. The, I think the general concern or the gist of their argument here is that 114L2 is meant to displace the disauthority in 114, sorry, 105D, and to the extent that it's an amendment and not something that they understand had to be, where the agency had to change its public regulations, then I think you could take that argument to be that there's no potential conflicts between those two provisions. The way we would understand that argument, I think, is that the savings provision says that the procedure should continue by their terms and nothing in 114L2 modifies those procedures. They are presenting an argument that it appears that it modifies those procedures only if it is not an amendment. And so I just think you can resolve the dispute on those terms. So turning to whether or not it is an amendment, I think clearly this is something that is, can be conceived as an amendment. If, you know, in ordinary contract negotiations, if one party, one party may say, I have an amendment, I would like you to make this change and I won't approve it otherwise. That is precisely what TSA is doing here. It's saying, it's expressing the conditions for its approval through the emergency amendments that it needs to issue immediately and doing the same type of thing that, you know, anyone would understand would not need to go through a formal kind of regulation. I would also say that it would make little sense for, I think, as the other side seems to suggest for every kind of amendments that takes this form to have to go through, be published in the federal register and kind of take its place next to the other applicable items. Again, this tool is designed for circumstances in which the TSA is confronting yet unknown threats. And so the other side seems to suggest that the regulations, the existing regulations bind TSA only to the kinds of threats that is already expressly considered by regulation. That doesn't seem to be a very sensible approach to me. And just as a matter of practice, I think, again, I would refer you to all of the materials that we've said it on a brief to how TSA has understood its own regulations to have often very substantive expressions of the necessary approval requirements from the 1972 advisory circle all the way through to these emergency amendments. In all of those circumstances, TSA has not understood it to be required to amend the regulations in order to issue an amendment to the airport. When you say approval, you mean approval of a security program? Correct. And so I guess the question on that is the way the regulations are framed, I'm not saying this means that doing this as an amendment is off the table, but what specifically needs to be contemplated by amendments is amendments to a particular security program that a particular airport or particular aircraft might have. I don't. This one speaks more broadly. It's not to say it can't be done that way, but it does seem like that's the heart of it. I agree that that's their position that TSA needs to individually redline airport security programs in order to effectuate policy in this area. The regulations do not require that. And I think it would make little sense for TSA to bind itself to not being able to say when there's an emergency that is equally applicable to all major airports to at one time issue an amendment to those airport security programs. That makes functional sense to me. So, I mean, I think the bottom line for the government is, look, I mean, in theory, you could do an amendment that applies, you could apply an amendment to every single individual security program. Yes, and TSA has done that. Correct. And that's what, I mean, it actually, for this one, it only applies to certain categories of airports that are quite large. Sure, those categories. But as to those, the functional upshot, recognizing that it's a subcategory of all airports, but as to those, and aircraft, but as to those, it's the equivalent of adding requirements to what's otherwise already in 103 for what a security program needs to contain. Sure, I don't think there's any doubt that sometime TSA will encounter new subject matters and it needs to, in the face of an emergency, take an immediate response. I mean, we've cited to the extent their argument is that the regulations itself constrain the agency. We've explained that those are not meant to be exclusive and that the kind of relevant definitional phrases indicate that they're not meant to be exclusive. And I just don't think there's a case to be made that TSA would, which traffics in ongoing and unknown emergencies, would require itself to go through a burdensome kind of pre-planning process rather than give itself the flexibility to issue an amendment when an emergency arises. If I could just try to take one more stab at, I think, clarifying why I think the text is pretty clear on the 114-L2, that if you do reach that question, I do think that the statute speaks to this in quite clear terms. Which statute? So, this is 114-L2. No, but when you say the statute speaks to it- 49 USC, 114-L2. That statute, the most straightforward reason why TSA did not exercise the tool in that statute, sorry, why it doesn't apply here is that TSA did not understand itself to be exercising any mechanism in 114-L2. 114-L2 is a tool that allows the agency to issue, to take a regulation and issue it without notice and without any further administrative back and forth. And the language of the provision, this is L2B, says that CSOB ratification will only apply to a regulation or security directive that is issued under that section. So, you're suggesting what the agency did here is more protective of public rights because there was notice? It's absolutely more protective of public rights. And it's absolutely true that I think the collaborative process here with the airports helped improve the emergency amendment in a way that would not have necessarily been the case otherwise. But I think the greater point is that Congress passed a belt and suspender statute that gave multiple mechanisms. One applies in the aviation sector. One applies across all modes of transportation. You're faced with it, the dispute on this issue is essentially with respect to this whether the condition to the bigger authority also applies to the smaller one. And Congress can decide whether or not it cares about that overlap. It decided in this circumstance that I think that CSOB ratification is appropriate only for 114-L2. That makes perfect sense because it is the type of broad and strong authority that would warrant CSOB oversight. We're talking about an order to transportation entities that would not just say all flights are grounded, but says all trains, all pipelines, all transportation entities are grounded, a top-down directive, and there's going to be no administrative back and forth here. In that type of circumstance, it makes absolute sense for a seven-headed board of other agencies to be consulted on national security matters. But I take the other side. I'm sorry, TSA could use L2 in the manner that, with a back and forth. Because, for example, it applies to security directives, so not just regulations. And why couldn't TSA say we're issuing a security directive which is going to require all airports to submit an updated safety program that accounts for cyberterrorism, and that will be then approved by TSA? So, the security directives, as I understand them, are temporary directives that don't work exactly through the same process and authorities. So, I wouldn't treat them as one and the same. Oh, security directive is a term of art that doesn't apply. It is a term of art in this area. I don't want to make too much of that, but I think our basic point is that there may be some overlap between what TSA is able to do through these provisions in the aviation sector. But the existence of that overlap is not surprising, given how broad the 114 L2 authority is. And it's important to note that if there is some overlap in the Venn diagram, that there's also extensive periods of non-overlap on both sides. On one side, there's the other modes of transportation through the 114 L authority. And the other side, you have, I think, quite tailored and quite narrow emergency amendments that are only meant to apply to a subset of airports, where it would be deeply surprising to expect that Congress wanted this super governmental body to micromanage this collaborative and iterative back and forth. So, is the upshot of that, are you saying that 114 L2 couldn't have been used to do this? Or are you saying Congress wouldn't have required it to be used to do this? Sorry, say the two options again. Are you saying that 114 L2 is something that could not have been used to do the exact same thing that was done here? Or are you saying it could have been used, but Congress wouldn't have required that to be used? It would have allowed the method that was used to be used as another way of doing it? If TSA had used the 114 L2 authorities, it would not have paid the prices in the regulation. Namely, the petitions for reconsideration that leave TSA open to APA challenges based upon its agency explanation, the fact that it only takes effect upon notice. I'm not standing here to say that TSA could not do something through the 114 L2 authority that would further its policy objectives in a similar way. But I don't think that's any different from TSA having, or agencies having the option to go through adjudication versus rulemaking. Then it sounds like you're saying that 114 L2 could have been relied on to do the exact same thing. Not to, it wouldn't be, if they did it, it wouldn't be the exact same thing. It would be in that type of circumstance, there would be no administrative back and forth between the- Procedurally, but substantive. You could not do substantively the same thing? Yeah, and we, because it's a procedural dispute here. Then the substantively- What I'm asking is substantively, could you do the same thing through, could you substantively do the exact same thing through 114 L2, granting that that would be a different process? Meaning TSA could have issued a requirement that tells, that has access control segmentation policies and does so through a 114 L mechanism. If it issued the requirement that way, in that type of circumstance, there would be administrative back and forth and that would take effect immediately. TSA has done that for other types of transportation, so there's references in the administrative record to pipeline, there's references to rail. In those circumstances, they don't have this legacy authority, and so they issue those regulations immediately. There is no back and forth with the regulated- Why can't they provide for a back and forth under 114 L2? They can. I mean, certainly they could. The agency, but I take the other side's argument to be actually that they could, that they either have to do 114 L2 or it's not- My question is just, and I don't know that it's important, but can you replicate exactly what happened here, including the back and forth under 114 L2, by saying in your L2 directive or regulation that there will be back and forth? Yeah, it wouldn't be exactly the same because, again, you would have this difference in when the regulation took its effect, but again, I'm not trying to stand here and say that there's not a quite similar thing that they could do or that what it did through an emergency regulation is ultimately so widely different from what you might expect the agency to do under 114 L2. The point here is that this is a belt and suspenders approach that was passed in November 2001, and the mere fact that there is some overlap between these provisions tells you nothing about whether Congress intended for these TSOB ratification procedures to apply in this narrow overlap that really only takes place in the aviation sector. I think Congress can decide whether or not it cares about those overlaps, and the text is really a complete answer to this question because it says that TSA doesn't need to get TSOB ratification when it doesn't exercise the tool in 114 L2. TSA didn't understand itself to be exercising this authority, and really it did. It's something that is different. Now, for better or for worse, that may raise other problems or other issues or other disputes that other petitioners can bring and present to the agency about the authority that TSA has, but it really says nothing about the scope of TSOB ratification. The text, I think, is a complete answer to that question, and it would be quite strange just to take a step back to go from a circumstance in which the FAA had a litany of tools in both the APA and its FAA authorities to one in which I think the other side is quite clear. I think TSA had one option, its most powerful medicine at all times, and had to use it. It would be strange for Congress to single out TSA in that fashion. The one that's the most powerful medicine is which one? 114 L2. Okay. Because it can do it immediately and it immediately takes effect and all that. And then it applies to all modes of transportation. Not to unlimited aviation. Yeah. Can I just ask this question just so I can keep track of where the government's making a non-preservation objection and where it's not? So there's this question that you've just had a helpful back and forth on about the potential use of 114 L2 versus the other route to go, which the agency, under the government's perspective, was what was adopted, which is going through the, I'll call it FAA legacy route, but if that captures it, great. Sure. Through the status quo. Yes. And has the government made the objection that the challenger's notion that this needed to go through 114 L2 rather than through the savings clause route? Has the government objected that that challenge wasn't preserved? I didn't understand the other side to be making an argument in their brief that the amendment is invalid because it went through the procedures of 114 D. They knew that TSA was going to go through the procedures of 114 D. And if they are presenting that argument that TSA had to, that it was unlawful for them to exercise a tool that was not 114 L2, then that argument is not preserved. It needs to be presented to the agency to the extent they're making it for the first time at the podium. We would urge this court to reject it. What we think that the argument that TSA needed to take an additional procedure beyond what is in 105 D, that it needed to, after it finished the administrative back and forth, it needed to get the amendment ratified by TSOB. We think that they are essentially put on notice of whether or not the agency goes through at the time that they get a denial of the petition for reconsideration. And so they can raise that on a petition for review in the first instance. If there are no further questions. All right. Thank you. Given the length of the back and forth, we'll give you three minutes for a rebuttal. Thank you. Now, Your Honor, with regard to Spokane Airport Board's concession, you just referenced 49 CFR 1542.105 D in conjunction with the concession. I want to make sure that the airport's concession were on the same page and have the same understanding. So, if this court finds that JEA 2301 was amending an ASP and it was not engaging in rulemaking, then I would agree that TSOB ratification wouldn't be necessary. But JEA 2301 does amend the regulation. Now, the airport's not taking the position that TSA can't amend airport security programs. They can. And they can do that under the regulation at 105 D. It allows them to amend airport security programs, but it does not allow them to amend regulations. And that's what they did here. Because 103 A, regulation 103 A, doesn't list cybersecurity. And TSA is attempting to use an airport security program amendment to actually amend 103 A to add cybersecurity. Now, it's true that the airport could do more in their airport security program, but TSA can't require more. Because the regulation at 1452.103 A, that's a ceiling for them. They're telling us what is absolutely required to be in the program. And it doesn't make sense to say, this is what's absolutely required in the program. But in the airport security program. But maybe there's more. And we'll tell you later. This is a list of what is absolutely mandatory to be included in the airport security program. So if they could just add topics, the question becomes, where do we draw the line? And could they add an additional topic of labor disputes? And then they're going to infringe upon the National Labor Relations Board. Just like here, where they're just adding a topic of cybersecurity. And then that's going to infringe on the Cybersecurity and Infrastructure Security Agency. You know, which is America's cyber defense agency. It's responsible for cybersecurity across all levels of government. So the real concern is where the line would be drawn, if at all. I'm just trying to understand what argument you're making, so we can decide whether it was preserved or not. So are you arguing that TSA did not have authority under 105D to do what it did? Yes. And so that is what the front of the slide, Mr. Lewis, says that you didn't argue. But as I discussed earlier, we did. We did preserve it. And in footnote one in the body of it, saying that there is no factual or legal support for TSA reaching in to try to control our information technology. And is it, are you arguing that the only route they could have taken was to go through 114L2 to do what they did? Add cybersecurity as an additional topic to a regulation. To amend that regulation on an emergency basis, TSA was required to go through 49 USC 114L2. So those are your arguments. They had no authority under 105D, and they had to go through 114L2. Yes. And then just to put a bow on the concession question, and thank you for clarifying this. If, hypothetically, we were to conclude that under 105D the agency could do this, you've presented a forceful argument as to why they couldn't. But if we conclude that they could do it under 105D, then the TSOB ratification question drops out in your. So that's not a concession that I would make, because that sounds to me like I would be conceding that under 105D that TSA can amend an ASP and effectively amend a rule. And I would not concede that. My concession is simply that if JEA 2301, in this court's view, is nothing but an ASP amendment, it's that and nothing more on that hypothetical, then TSOB ratification wouldn't be required. But again, our position being that it did more than that. They're trying to use an ASP amendment to amend a regulation, which is going to require a different procedure. And again, a guaranteed procedure, because the procedural guarantees are more than courtesies that we hope will be afforded. They're guaranteed by statute. And because we weren't given that, they didn't follow the correct procedure. Airports respectfully requesting that this court reverse the denial of the petition for reconsideration and vacate JEA 2301. And so just to follow up on the waiver issue that we've talked about, there's a line of argument that you didn't raise these arguments before the agency. Therefore, they're not exhausted. The government didn't raise the fact that you didn't raise them. So they kind of waived their waiver argument. But we have a case law that says the government can't waive these types of arguments because it's jurisdictional. But you haven't argued that it's not jurisdictional. So you've waived the argument that it's not jurisdictional. I'm sorry, Judge, was that a question? I'm just, do you agree with me that you've not raised that and therefore you've waived any argument that these waiver arguments are jurisdictional? I disagree with the proposition that we didn't raise those for the reasons that I've already stated. But I also would put forth that the statute requires that an objection be made. It doesn't require that the petitioner be the one that made the objection. Just that an objection was made. And again, in the memo to the TSA administrator that I referenced before, it listed, you know, not even all, but it listed objections that were made. Statute doesn't require that it be spoken. Airport Board make it. It just requires that an objection be made. An objection was made. It was acknowledged by TSA and I believe it's preserved. Thank you. Thank you, counsel. Thank you, counsel. We'll take this case under submission.