Anthropic v. U.S. Department of War: A Hearing Diary
On July 30, U.S. District Judge Rita Lin of the Northern District of California held a hearing on cross-motions for summary judgment in Anthropic PBC v. U.S. Department of War. In the suit, Anthropic is challenging the Department of Defense’s unprecedented designation of Anthropic as a supply chain risk last March under 10 U.S.C. § 3252. The dispute arose out of Anthropic’s refusal to permit the government to use its frontier artificial intelligence products for lethal autonomous weapons or mass surveillance of the U.S. population. Anthropic alleges that the designation was unconstitutional punishment for First Amendment protected speech and also violated its Fifth Amendment Due Process rights and the Administrative Procedure Act. The government alleges that its actions were justified by legitimate national security concerns that grew out of distrust of the company and concern that undisclosed guardrails, built into its products to effectuate the company’s private view of morality, could risk the safety of warfighters and civilians.
Last March, Judge Lin granted a preliminary injunction in favor of Anthropic. The parties agree that the case is now ready for final decision on the merits on the basis of the written record. (Anthropic has a similar suit pending against the Defense Department in the U.S. Court of Appeals for the D.C. Circuit to challenge a supply-chain risk designation Secretary Pete Hegseth made at about the same time under a different statute: 41 U.S.C. § 4713.)
Lawfare’s Roger Parloff live-posted the hearing as it happened, by following on a Zoom feed. Read his account by clicking the button below or by viewing his thread on X here.
Liveblog
At 1pm ET / 10 am PT Judge Rita Lin (NDCal) will be holding a hearing in @Anthropic v. @Department of War 🇺🇸 [sic]. It's on cross-motions for summary judgment, meaning each side seeks a final decision on the merits based on papers. I’ll try to live-post for @Lawfare … /1
Anthropic is seeking a permanent injunction to stop the DOD's designation of it as a "supply chain risk." It alleges that the declaration was to punish it for 1st Amendment protected speech, among other claims. Judge Lin issued a preliminary injunction earlier. ... /2
Judge Lin issued a list of 5 questions she wants to the attys to be prepared to answer. She will likely ask them to address those first. You can find those here: https://storage.courtlistener.com/recap/gov.uscourts.cand.465515/gov.uscourts.cand.465515.242.0.pdf ... /3
Anthropic filed 2 cases, because the DOD invoked two "supply chain risk" statutes. The NDCal case (today's hearing) stems from 10 USC 3252. A parallel case relating to 41 USC 4713 is pending in the DC Circuit, where that statute requires those claims to be brought. ... /4
I am listening to a Zoom hookup, which the NDCal allows. They're getting the judge now. /5
All rise. [Just audio, no video.] Counsel are giving appearances. Plaintiff's lead: MIchael Mongan from @WilmerHale ... DOJ: James Harlow with Christian Dibblee. /6
Judge Lin wants to start with some of her impressions than go her questions. She'll reserve time for attys to bring up other matters. having reviewed the record it appears to me to be largely the same as record i assessed at prelim injunction stage. dont see additional /7
evidence from govt that [improves] their position. if anything it's gotten worse. don't see any nefarious signs ... Anthropic criticized DOW's positions in the press. and that created "a lack of trust," per govt. govt saying if contractor criticizes govt, govt can turn around /8
and say we dont trust you and govt can go ahead and retaliate, say they're an enemy of the state, taking away their contracts ... etc. Really troubling. at odds with 1st Am, with 3252. would like to understand if that's really govt's position. cause it seems quite extreme. /9
if that's not govt's position, want to know [how govt sees it]. let's go thru more fine grain questions i have. start with Q1. /10
[she's reading the question now. It's about the pickering framework.] does it really apply when govt goes beyond terminating contactual relationship. 2d part of questions is a hypo to illustrate [my point]. ... /11
DOJ (Harlow): it depends on nature of hypothetical punishment. that comes from Umbehr. ... fact-intensive inquiry. Pickering is correct framework to apply. If govt is exercising more general regulatory power, Pickering would not apply. Our case: govt has acted as contractor. /12
Judge: one question i have. you use term regulatory. Not quite term Umbehr uses. it uses sovereign power. do you see govt conduct that attempts to deter on broader scope than just individual contractor by deterring from public criticism -- you see that as regulatory? /13
DOJ: by terminating a contract, you could see that as pressuring a company, but that's squarely within Umbehr. Judge: but govt is out there saying this is a warning to all of you, we're making public example of this company. you should never criticize govt in this way. ... /14
J: you think Pickering is correct framework? DOJ: yes, YH J: even if purpose is deter a broader swath of people watching? DOJ: ... if govt's messaging is directed to other contractors--remains withiin pickering. /15
Judge: so, the secondary boycott in this case--any defense contractor who does business with Anthropic would have contract terminated ... if that were still in effect -- beyond pickering? DOJ: no longer in case, but if it were across the board [like that] ... that's getting more into regulatory framework. /16
Judge Lin now referring to Hegseth's original declaration, which imposed a secondary boycott--would that go beyond pickering? DOJ Harlow: to extent action govt took had no nexus to any govt contract Judge: so if Hegseth's original had come into force ... DOJ Harlow: if it's unrelated to a covered system, how to see how Pickering would apply /17
Judge: suppose it was implemented just as Hegseth originally said ... nobody can conduct commercial activity with Anthropic ... DOJ: can't give a categorical answer. 3252 applies to all covered procurement actions. we dont need to speculate. we know secy's social media statement was reduced. he has no legal authority beyond the covered procurement actions in the statute. /18
Judge: suppose contractor is terminated becausae they did unrelated work with Anthropic ... Pickering would not apply, would you agree? DOJ: it wouldn't be that 3d party contractor bringing the claim. if contract entirely unrelated to covered systems of DOW, the case law doesn't appear to have extended pickering to that situation. /19
[Pickering is a doctrine that permits the govt to have more leeway to constrain speech when govt is an employer constraining speech of an employee or independent contractor.] /20
Judge: if govt said ... reason we're doing this is to stop unfair criticism of the president. does pickering apply? DOJ: yes. Umbehr & Pickering are equipped to handle that sort of scenario. The govt has to prove that it has a legitimate govt business. /21
Judge: so one could use Pickering framework and still violate 1st Amendment in that case? DOJ: [implies that that's right]. that's not this case. Judge: i'm surprised you can't give a yes to what seems to be an easy case. DOJ: i've given best answer i can. in contrast to national security interest we've raised here, if it is just a pure, we dont like any criticism whatsoever, SCOTUS hasn't recognized that as legitimate interest. dont want to foreclose any hypothetical argument. /22
J: what if in my hypo, govt is announcing it's terminating all defense contracts of anhyone who has ever criticized the president. ... chilling effect ... govt says reason we did this is because we can't trust you. now that you criticized president you might be anti-american. pickerign still applies? DOJ: correct. /23
J: would there be a violation of the 1st Am DOJ: it depends what facts govt can present to justify its position. Here, we think record amply demonstrates why Secy reached conclusion that facts justify a "supply chain risk" [designation]. not mere loss of trust here. /24
J: suppose added to billboard: nobody better do business with this company or else--pickering would not apply? DOJ: veering more toward exercise of sovereign or regulatory power J: i look at holistic sum total of govt's conduct . the hegseth directive. the presidential directive. then the formal designation. /26
DOJ: there would be a 1st Am analysis for P's post. 1st Am analysis for Secy's analysis. (we view as only the 3/3 letter, not the february post.) J: but assessing each challenged actdion, i need to look at context of what govt is doing as a whole, right? DOJ: each govt actor has different powers. POTUS has powers Secy does not [have]. /27
DOJ: there's a tendancy to lump all the defendants together. but each defendant operates in discrete authorities. not a monolith. J: i dont see a record made by President about the threat Anthropic posed. i can't consider what DOW knew and thought? DOJ: the record evidence as of date of POTUS's Truth Social post on 2/27. /28
J: doesn't look there's any info in record as of 2/27 about whether Anthropic posed a threat. DOJ: the DOW docs ... J: how do I know President saw that? DOJ: just evaluate on face of his Truth Social post. the parties agree that the record is the record. /29
J: i'll give plaintiffs an opp to respond. Michael Mongan: we have material dlifferences of opinion as to how pickering frameowrk operates. as to 1a, pickering applies when there's an employer/empoyee relationship or something closely analogous and challenged action is normal day-to-day action ... /30
MM: doesn't apply to all govt contractors or all actions taken to retaliate against [one]. terminating a contract could be like firing someone for cause. but it doesn't extend to exercises of sovereign power. here, pickering doesn't apply becauase providing frontier AI to DOW is not remotely analogous to anything an employee would do. /31
Plus, actions we challenge here are not similar to day to day managmeent of employees. they are classic exercises of sovereign power. this is not ordinary contracting to manage efficiency of public services and make sure there's order in teh workplace. easy to answer the question in this case. there's a whole body of law that addresses procurement. /32
if you want to ask what an employer would ordinarily do, turn to the procurement laws. ... that's not what they did here. each of challenged actions is classic exercise of sovereign power. the secondary boycott is still out there. X post is still out there in the public record. says no contractors can do business with Anthropoic without [consequences]. immediate debarment of Anthropic is exercise of sovereign power. /33
MM: even the exercise of 10 usc 3252 is unprecedented exercise of national security authority affecting all covered systems. some staggering implications to answer you just heard about the hypo. the govt could come out and say any contractor who criticizes fed govt is subject to punitive actions and that would be subject to pickering balancing would lead to immediate diminishing of their 1st Amendment rights. /34
MM: the reason you're not getting clear answers from the opposing lawyer is he's a good lawyer and realize those hypos may very well be the next case. our view--even if you apply pickering, our 1st Am claim would prevail. J: what is your view on how i look at 1st Am claims. look at actions as a whole to determine whether they were to retaliate--all 3 actions together. but govt says i should separate them out and look at separately. /35
MM: i don't see how you can separate them out on this record. POTUS post 2/27. Secy's post is a few hours later. Follow-on actions a few days later. all of these are entangled. makes sense to look at big picture. but even if you looked at them individually, answer is same. all violate 1st Am. /36
Judge moves to Q2. would it eviscerate 1st Am protections. ... DOJ: Pickering framework more than adequate to address this situation. plaintiff makes prima facie case, then burden shifts to govt to show its interest outweighs 1st Am interests. not simply about pubic criticism of DOW--lot more going on. /37
DOJ Harlow: what's happening here, dealing with frontier AI tech, which is a bit of a black box. opaque by its very nature. not like procuring a rifle. you can dissemble a rifle and make sure it's produced to your specs. not the case with frontier AI products. Anthropic also has privileged access to these models. /38
DOJ: nothing prevents Anthropic from deeloping new policy positions and baking them in with guardrails which may or may not be disclosed to DOW. DOW needs to trust AI vendors to be forthright and about what guardrails have been installed. J: so you're saying, okay for govt to say a contractor is a potential subversive because he can't be trusted -- fine & supportable in AI context? DOJ: not solely. there need to be articulable facts for why the trust is lost. this is laid out in undersecy michael's memo. /39
DOJ: but risk is much greater with AI than with ordinary hardware. Also, not a onetime transaction. With AI, dept needs access to latest AI models. to update it is not like doing software match. it has to be installed on system. each new update is new opportunity--need to think, has there been a new guardrail slipped into this model? /40
J: Is that really so diffefrent from other defense contractors. Drones ... each shipment could be different. is there a software component slipped in that could cause it to self-destruct? DOJ: AI is fundamentally different--not just from physical hardware--but even from traditional software. nature of these models is staggeringly enormous and opaque, dept can't peek beneath the hood and evaluate it in same way as with hardware. /41
J: what are articulable facts? DOJ: risk of AI poisoning. Undersecy applied risk framework. sum of whole is greater than each of the parts. parts secy identified: refusal of Anthropic to permit all lawful uses. dept never asked anthropic to produce a special model. dept wants to use the product wihtout external limitations Anthropic would impose upon it. /42
DOJ: a high level Anthropic official questioned use of a product during a military operation ... outreach ... why would you ask the question? J: what was teh question. not explained in the materials. DOJ: not suitable for public recrod. about ongoing active military operations. questioning propriety of the use. whether right for Anthropic's tech to be used for this ongoing operation. /43
J: do you think record precludes possibility that question was, "is it a good idea to use the product in this situation?" DOJ: yes. The prime contractor also grew concerned by the mere asking of the question. not within the purview of any company exec to question how & why its tech is being used. that gets to a "corporate moral judgment" that may be baked into a future version of the model. /44
J: so your articulable facts are contractual refusal and then the questioning? DOJ: and then ... undersecy had questions about safeguarding classified details. Anthropic raised the dispute -- the contract negotiations -- in late feb that Anthropic disclosed the nature of these to the public. said it was being threatened by DOW. directive within the company that expressed hostility to current DOW leadership. permissible under 1st Am case law--speech can be viewed as evidence of intent. all goes into the mix--does this company see itself as a partner or, in terms of 3252, the adversary supply-chain relationship. /45
DOJ: there should be deference to these officials. it's secy who bears ultimate responsibility for safeguarding nat sec systems. J: plaintiffs? Michael Mongan: So Q2 ... it would certainly violate 1st Am. we've addressed in briefing. explanations have evolved and shifted during this litigation. now this focus on trust. /46
MM: glad to hear DOJ acknowledge they need to point to specific articulable findings ... my colleague points to undersecy's risk analysis memo of 3/2. note that work on risk analysis memo took place after the directives of 2/27. setting that aside, heard a lot about the nature of frontier AI. perhaps more opaque. developer has privileged access. true of all frontier AI companies. has to be more than that. resist notion that because of these features, it's so different that 1st Am safeguards are radically different. /47
MM: what are articulable facts supposedly limited to Anthropic. "refusal to permit all lawful uses." the two anthropic specified have always been specified. govt knew that. so hard to swallow, all of a sudden on 2/27, this elevated the situation from contract [dispute] to supply chain risk. speaking with the press is a core 1st Am protected activity. you may not like contractor. may decide not to contract with them. doesn't make them supply chain risk. speaking publicly of great public significance--like AI safety and responsible use of your own models--creates situation where you are a supply chain risk and sanctioned by govt. /48
MM: question about use of Claude in a foreign situation. assume it's correct. doesn't remotely take you to conclusion that anthropic is an adversary bent on [undermining goals of govt]. question at issue was raised by one Anthropic exec to a 3d party. no evidence nobody took step to interfere in ongoing operation. Anthropic's CEO made clear not concern with foreign operations. Anthr went to meet with Hegseth in person, assured him we had no interest in interfering in those oeprations. and made clear they wouldn't in contract. /49
MM: if assuming a saboteur who is an adversary of the US--the last thing that person would do would make a principled stand about the importance of particular usage restrictions in terms of safety and responsible use. they'd just go ahead and promise anything and go ahead adn do their sabotage. /50
MM: heard my colleague say this is about pre-deployment model control. but that was not key thing in risk-analysis memo. concern was post-deployment. only once we made clear anthropic has no post-deployment control, did they pivot and start to focus on pre-deployment model control. that shifting of rationales is powerful evidence of pretext. problem for them both with respect to 1st Am and APA claim. /51
J: let me move to Q3. DOJ Harlow: we're not entirely sure what prompted this question. agencies' conduct beyond scope ... but to answer it ... the dept of war continues to wind down use of Anthropic products. process remains ongoing. scheduled to be completed by 9/30. /52
DOJ: there's a fair amount of nuance with respect to each agency's relationship to Anthropic. several using on pilot basis, winding down by August. fed govt dipping its toe into AI. exploring what tools are out there. agencies often using them thru 3d party vendors. /53
J: i hear you sahying DOW is winding down and will be done 9/30. DOJ: right J: most agencies still using? DOJ: preexisting pilots ... agencies have continued to carry out pilot programs. already slated to expire 8/30. J: Question 4: have any expanded use of Claude? /54
DOJ: defendants very respectfully object to this question. calls for confidential info ... calls for govt wide info about nat sec tools in this setting. also calls for conduct that post-dates agency action. outside record, not before def agencies. J: if true that DOW believes Anthropic to be nat sec threat that going to poison AI model, seems inconsistent for DOW to be, as reported, to be using Anthropic and expanding its use of teh AI model. doesn't that seem relevant at least to 1st Am claim? DOJ: any subsequent actions--Mythos model--not reflected in administrative record ... /55
J: sometimes someone's actions after the conduct in question give insight into their intent? DOJ: i appreciate that. i'm not authorized to give a substantive response today, but it might be possible for parties to meet and confer and for us to submit something afterwards. need to be careful about what we're providing and how. /56
J: plaintiffs? Michael Mongan: start with Q4. i hear govt saying this calls for sensitive info. maintaining strong relationship with govt is important to anthropic. we do think this is relevant for reasons YH indicated. that said, Anthropic's main priority is final judgment that will provide full relief against these unprecedented actions. if court interested in pursuing further, suggest we speak in camera ... maybe short filing tomorrow. but we'd hope that any further discussions would not delay the court in resolving this motion. /57
MM: regarding Question 3. most agencies have continued to work with Anthropic. 2 have paused contracts. we're not aware of any that have canceled any since preliminary injunction. we have limited info about extent to which agencies are "winding down" use. only 2d hand info. /58
J: my last question--this one for Anthropic: shouldn't any remedy also include a remand to allow DOW to attempt to make lawful [revision]? MM: default remedy which agency action is found unlawful--vacate and remand to agency. as practical matter, no viable way for DOW to lawfully designate Anthropic a supply chain risk on remand. as formal matter, we wouldn 't object tho. On 2d part ... agree no remand as to secondary boycott. DOj acknowledges no authority to do what he tried to do there. DOJ: as we argued, if inadequacies in 3252, this case is a prime candidate for remand without vacatur. DOW likely to remedy any deficiencies or procedural oversights and reach same decision. /59
DOJ: if court does invalidate the 3/3 order, we don't think you need a remand. as to secondary boycott, we dont see any -- if court would like secy to clarify whether secondary boycott exists -- remand without vacatur would bge appropriate. but if court is going to vacate 2/27 post, remand doesn't matter. /60
Michael Mongan (for plaintiffs): regarding remanding without vacatur ... not appropriate for situations with serious errors. can't imagine more serious errors than here. DOJ: want to offer rebuttal on some points. ... whether govt has exercised sovereign powers ... sovereign is imprecise. everything govt does is sovereign. really it's about regulatory work. /61
DOJ: for Q2, i forgot ... an additional risk factor. the CDC example. DOW has pointed to as demonstrated how it might manifest. J: but that was, they were using commercial model. it had restrictions. DOJ: but it demonstrates, there was a guardrail. ... CDC tried to use for permitted use, but it wouldn't because of a guardrail. that's what DOW fears. in a scenario where warfighters & civilians safety could be at risk. /62
DOJ: Mr. Mongan mentioned ... fact that DOW knew Anthropic's pre-existing statements about safety ... yes, but that favors us. nevertheless, DOW continued to work with the company. not just about company's speech. it was about additional factors i went through. On Question 4 ... Mr. Mongan asked for response by today or tomorrow. I would ask for week. just given nature of info sought and all the agencies. would take a lot of work to hash out a response. /63
DOJ: none of questions touched on due process or ultra vires J: i thought it was well briefed and i dont have questions DOJ: as to APA claim -- [Admininstrative Procedure Act] ... Anthropic had burden to put forward ... J: if something Anthropic said about actions of agencies that wasn't accurate, [say so]-- DOJ: a number of these agencies didn't have direct contract relationships with Anthropic. they have contract with 3d party cloud provider that has whole bunch of options, including use of Claude. ... shouldn't have judicial review of these work-a-day IP decisions. /64
DOJ: given some of Anthropic's concessions, seems that at least some defs are entitled to summary judgment. At least the EOP, the social sec administration, NEA, Does 1-10. Proposed order lumps together various actions and defendants; i think that's inappropriate. If court is going to find for Anthropic on any of the APA claims, court has to decide if equitable relief is warranted. we dont think so. /65
DOJ: but if court disagrees, important to tailor equitable relief to particular defendants. ... Also, any order should preserve right of agencies to stop using Anthropic. to extent these are ordinary procurement decisions, agencies have right to terminate contracts without cause. Also no basis for the compliance report included in the proposed order. no question of defendants' compliance with the preliminary injunction order. /66
Michael Mongan responding, for Anthropic: On Pickering, if govt exercises ordinary procurement authority, that could fall within Pickering. but here POTUS goes beyond that to just debarment, and secy following up, that very readily falls into sovereign, regulatory power. /67
MM: on question of MM: all AI models have guardrails. in CDC, it was using commercial model. we built govt model [to prevent this problem.] On Q4 ... govt had this question since Monday. timing does matter. we've been laboring under unc'l orders since February. campaign of retaliation. important to company to have final judgment that will provide us with relief expeditiously. Overarching point: separation of powers. Step back, suggestion seems to be there's no way for entitty to get any review of a presidential directive that concededly is not exercising any statutory authority and violates 1st Am and Due Process. That can't be right. /68
MM: we appreciate court and defs moving quickly. these are actions that profoundly harm anthropic and threaten to chill debate. Judge: I'll will take the matter under submission and issue a written order Adjourned. ... /69
.jpg?sfvrsn=68f3cd7e_4)
