Why Anthropic Is Asking for a Rehearing En Banc

Though not dispositive, legislative history can provide useful information in the resolution of cases. Information arising from hearings, reports, and floor statements can provide courts with valuable insights when interpreting the meaning of legislative text. Some observers predicted the death of legislative history as a tool in statutory interpretation after Justice Elena Kagan quipped, “We’re all textualists now,” and equated citing legislative history with “putting extra icing on a cake already frosted.” Yet justices across the Court’s interpretive spectrum have recently shown a willingness to go beyond mere text to ferret out the meaning of a law.

Consideration of the legislative history of the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA) brings the recent decision by the U.S. Court of Appeals for the D.C. Circuit in Anthropic PBC v. U.S. Department of War into question. Judge Gregory Katsas, joined by Judge Neomi Rao, wrote for the majority; Judge Karen LeCraft Henderson dissented. The majority concluded that Anthropic’s conduct qualified as a “supply chain risk” under FASCSA and upheld the decision by the Department of Defense—referred to as the Department of War by the parties—to exclude the artificial intelligence (AI) lab from portions of the department’s supply chain on that basis. Anthropic has requested a hearing en banc—an appearance in front of all active D.C. Appeals Court Circuit judges.

Assuming that petition is granted, the D.C. Circuit, in interpreting FASCSA’s definition of “supply chain risk,” should acknowledge and heed the specific harms Congress sought to address. If the court does so, it will likely reverse the previous decision.

Background

Anthropic and the Department of Defense started 2026 amid contract negotiations. Anthropic refused to agree to a contractual requirement by the Department of Defense that its technology may be used for “all lawful use.” The frontier AI lab insisted that it would not permit the use of its Claude AI model for domestic mass surveillance or in fully autonomous weapons systems. Contract negotiations broke down over these red lines. On Feb. 27, Secretary of Defense Pete Hegseth responded to the impasse via a social media post expressing his intent to remove Anthropic from the federal supply chain. Then, on March 3, he relied on FASCSA to formally remove the company from the federal supply chain. The Department of Defense’s determination concluded that ongoing use of Claude in the department’s system represented a “significant supply chain risk,” requiring the removal of the company’s tools. The department subsequently mandated that all Anthropic products be removed from department systems within 180 days. It also foreclosed Department of Defense contractors from using Claude in department-related work.

Anthropic challenged that determination in lawsuits brought before the U.S. Court of Appeals for the D.C. Circuit and U.S. District Court for the Northern District of California. The former suit challenged the government’s interpretation of FASCSA; Judge Rita Lin concluded that the government retaliated against Anthropic for its criticism of the administration in violation of the First Amendment. The latter case pertains to the application and meaning of 10 U.S.C. § 3252. In its relevant part, the law defines “supply chain risk” as (emphasis added):

the risk that any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.

Anthropic does not contest the Pentagon’s right to discontinue using it on covered projects and, on the contrary, volunteered to help it transition seamlessly to another provider. It simply wants the department to follow procurement laws rather than stigmatizing it as a supply chain risk, a term it contends is associated with malicious actors.

The majority saw no need for bad intent in labeling Anthropic a supply chain risk under FASCSA. On its reading, the Department of Defense’s decision to regard the frontier AI lab as a “supply chain risk” turns on the wording “otherwise manipulate”; and manipulation, per the American Heritage Dictionary cited by the majority, means simply “[t]o move, arrange, operate, or control by the hands or another body part or by mechanical means, especially in a skillful manner.” 

Under that definition, nearly any deliberate design choice could qualify as manipulation and expose any company to being labeled as a supply chain risk. The majority brushed aside Anthropic’s argument that FASCSA’s legislative history points the other way and opted not to thoroughly address the counterargument that supports reading malice into the statute.

Consideration of legislative history bolsters the case that Congress did not seek to punish companies for offering a product that, for whatever reason, does not align with the demands of the federal government. Read with the enacted language, the legislative history identifies a security problem involving compromised products, vulnerable components, exploitation of trusted access, and interference with information systems. It does not establish that every deliberate and disclosed limitation on a product’s capabilities constitutes the sort of manipulation contemplated by FASCSA.

The Legislative History of “Supply Chain Risk”

There is a difference between a literal reading of a statute and a textual one. A literal reading assumes Congress expected courts to reach for the nearest dictionary, just as the majority did here. The Supreme Court drew that distinction in Fischer v. United States, another case about how far an “otherwise” clause reaches. To fix the clause’s scope, Chief Justice John Roberts wrote, “the Court must decide how it is linked to its ‘surrounding words.’” The Court then confirmed its narrower reading by looking to the problem Congress set out to solve: the Enron-era loophole that prompted the provision.

The majority in this case declined to undertake that broader inquiry. Its treatment of FASCSA’s legislative history spans two sentences. The first rejects Anthropic’s attempt “to glean from the legislative history a focus on 'foreign companies working at the behest of foreign states,'” because the statute covers “any person,” which “cannot refer only to foreign entities.” The second rejects, without elaboration, the dissent’s “use of legislative history ... to glean the ordinary public meaning of the seven verbs in the definition.”

The first point is easily resolved. Nothing in FASCSA limits supply chain risk to foreign actors. But the key inquiry here is not so much which actors can be labeled a supply chain risk but rather what conduct may qualify an actor as such.

On that question, the surrounding words and context cut against the majority’s reading of FASCSA. The congressional committee reports, hearings, and floor statements that produced FASCSA describe one kind of problem: people, foreign or domestic, outside a vendor or inside it, covertly compromising the technology the government buys. Nowhere does the record suggest that Congress intended to reach vendors that openly tell the government what its product will not do.

Congress’s focus on hostile and covert conduct matters because the majority has already conceded the facts that make stretching “otherwise manipulate” to Anthropic’s behavior hard to justify. The majority noted it had “no reason to doubt” that Anthropic had “noble intentions” when determining the functions of its models. It also had “no quarrel” with the Northern District of California’s conclusion that Anthropic “has acted with no such bad motive in its dealings with the Department.” If the definition requires hostile conduct, Anthropic falls outside it.

The Problem Congress Set Out to Solve

Several sources supply the relevant context: two committee reports, two congressional hearings, and the House floor debate.

The Senate Homeland Security and Governmental Affairs Committee’s report on S. 3085, the bill that became FASCSA, opens its “Background and Need for the Legislation” with a single framing sentence: “Hostile nation states and other bad actors are attempting to gain unprecedented access to sensitive and classified information via the Federal Information and Communications Technology (ICT) supply chains.” The report traces a “well-documented history” of warnings that “foreign governments may target the Federal ICT supply chain via certain products or services.”

The report also quotes then-FBI Director Christopher Wray, who said that the bureau was “deeply concerned about the risks of allowing any company or entity that is beholden to foreign governments that don’t share our values to gain positions of power inside our telecommunications networks.” Such a position, Wray explained, “provides the capacity to maliciously modify or steal information, and it provides the capacity to conduct undetected espionage.”

The report then states that “[t]he need for this legislation is underscored by several recent examples of supply chain risks discovered within the Federal ICT system.” The examples it gives are Kaspersky Lab, Huawei, and ZTE. A closer look at the first of those examples shows what kind of conduct motivated Congress to pass FASCSA.

Consider what the concern about Kaspersky actually was. Then-Acting Homeland Security Secretary Elaine Duke explained that the department removed Kaspersky products from federal networks because of its concerns about “ties between certain Kaspersky officials and Russian intelligence.” She also cited Russian legal “requirements ... that allow Russian intelligence agencies to request or compel assistance from Kaspersky.” Duke’s conclusion: “The risk that the Russian government, whether acting on its own or in collaboration with Kaspersky, could capitalize on access provided by Kaspersky products to compromise federal information and information systems directly implicates U.S. national security.”

Rep. Kathleen Rice (D-N.Y.) put it more bluntly at a House hearing in July 2018. Although Kaspersky was “a long-time Government vendor,” she said, “the FBI had reason to believe the Kaspersky programs contained back doors that could be accessed by Russian intelligence.”

This background reveals that the government in the Kaspersky matter did not need to prove that Kaspersky itself harbored hostile intent. The risk was that someone, namely “the Russian government, whether acting on its own or in collaboration with Kaspersky,” could exploit the vendor’s access. Understanding this dynamic shines a light on the role “any person” plays in FASCSA: The risk can come from whoever is positioned to exploit a product, not only the vendor of record. In every version of the Kaspersky story, though, someone is trying to compromise federal systems without the government’s knowledge.

The same is true of the cases involving Huawei and ZTE. The Senate report outlines the government’s position that their equipment “may be used for nefarious or otherwise unauthorized purposes by the Chinese government.” It also quotes the House Intelligence Committee’s 2012 warning: “Inserting malicious hardware or software implants into Chinese-manufactured telecommunications components and systems headed for U.S. customers could allow Beijing to shut down or degrade critical national security systems in a time of crisis or war.” At the House hearing, Rice commented on both companies having “close ties to the Chinese Government” and being “possible vehicles for cyber threat and espionage.”

The House record resembles the Senate’s. The House’s companion effort was H.R. 6430, the Securing the Homeland Security Supply Chain Act of 2018. It grew out of a July 12, 2018, joint subcommittee hearing titled “Access Denied: Keeping Adversaries Away from the Homeland Security Supply Chain.”

Rep. Peter King (R-N.Y.) opened that hearing by observing that “nation-states and criminal actors are constantly trying to exploit U.S. Government and private-sector systems to steal information or insert potentially harmful hardware or software.” He then set forth the purpose of supply chain risk management (SCRM): “The foundation of any SCRM program is the ability to proactively identify entities seeking to exploit the DHS acquisition process, become trusted vendors, and then steal from or otherwise harm the Homeland Security enterprise.”

King’s description is the closest the record comes to anticipating the application of FASCSA’s supply chain risk designation to a vendor already in good standing with the government. Yet, even in his hypothetical, the trusted status was a cover for theft or sabotage. Anthropic’s restrictions on Claude differ from that fact pattern. They were written into contracts, negotiated over months, and publicly explained by the company’s CEO. The majority opinion itself recounts that Anthropic “partially—but not completely—relaxed its use restrictions to accommodate the Department.” The lab did so by building a government-specific model and a government-specific usage-policy addendum. Yet, as Judge Henderson put it in her dissent, the conduct the majority’s holding reaches is “a contractor’s honest and upfront enforcement of restrictions on a covered article’s use disfavored by the government.”

How the Definition of Supply Chain Risk and “Otherwise Manipulate” Took Shape

The definition of supply chain risk evolved across three related proposals. Tracing that evolution further undercuts the majority’s reading of “otherwise manipulate.”

The starting point is the Defense Department’s Section 806 authority, enacted in 2011 and now codified at 10 U.S.C. § 3252. It defines supply chain risk as “the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a covered system so as to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of such system.” The Northern District of California read that definition to require bad motive and determined Anthropic’s behavior did not qualify as such.

In the summer of 2018, the House drew on that language for H.R. 6430. The House bill made three changes: It replaced “an adversary” with “a malicious actor,” it added “extract or modify data” to the first string of verbs, and it substituted “manipulate” for both “subvert” and “degrade.” The result defined supply chain risk as “the risk that a malicious actor may sabotage, maliciously introduce an unwanted function, extract or modify data, or otherwise manipulate” a covered article “so as to surveil, deny, disrupt, or otherwise manipulate” its function, use, or operation.

FASCSA, enacted that December, kept nearly all of the House’s language. It trimmed “extract or modify data” to “extract data.” It also changed the actor once more, from “a malicious actor” to “any person.”

The decision to insert “otherwise manipulate” into the definition was not to expansively increase the kinds of conduct it covers. It first appears in H.R. 6430, which expressly focused on behavior by “a malicious actor.” The members who managed that bill explained it as a continuation of the 2011 authority, not as a tool reaching a broader range of conduct. King told the House the authority “is modeled after existing authority granted to the Department of Defense in 2011.” Rep. Bennie Thompson (D-Miss.) said it “is based on a similar authority provided to the Department of Defense in 2011 and incorporates language provided by the Office of Management and Budget.” The committee report is also aligned with this connection: “The authority in H.R. 6430, is based on DOD’s Section 806 authority and includes important components from the OMB proposal.” Whatever drove the swap from “subvert” to “manipulate,” it happened in a bill its sponsors framed as a malicious-actor authority modeled on a statute keyed to adversaries.

How the Record Uses “Manipulate"

The hearing record also shows how the people drafting and debating the bill used the word itself. As Judge Henderson noted, citing Bostock, evidence of how a term was used before enactment “sheds light on what sense those words are meant to carry.”

At the July 2018 House hearing, every use of “manipulate” in the supply chain context carried the hostile definition. Rep. Luis Correa (D-Calif.) said: “The Federal Government supply chain is a target for our adversaries and we need to ensure that commercial off-the-shelf goods and services are not the subject of manipulation.” The Government Accountability Office’s (GAO’s) Gregory Wilshusen warned of “the risk that these systems are being manipulated or damaged by leading foreign cyber threat nations, such as Russia, China, Iran, and North Korea.” Those threats, he said, could allow “adversaries to take control of systems, extract or manipulate data, or decrease the availability of resources.”

Wilshusen’s phrase “extract or manipulate data” closely tracks the law’s phrasing “extract data, or otherwise manipulate.” In his telling, it characterizes something adversaries do. The reports agencies sent to Congress used the same vocabulary. Judge Henderson’s dissent cites a U.S.-China Economic and Security Review Commission report describing attackers who “surveil[ed] and manipulate[d] users by hacking ... embedded [computer] firmware.”

The one neutral use of the word in the hearing record also cuts in Anthropic’s favor. GAO quoted the standard definition of information technology: equipment used in the “automatic acquisition, storage, manipulation, management, movement, control ... of data or information.” That is the ordinary, skillful-handling sense the majority adopted, and it summarizes what every covered article does. FASCSA incorporates that very definition of information technology into its definition of “covered article.” If manipulation in that sense were sufficient to create a supply chain risk, every product the government buys would pose one.

The Government’s Likely Counterarguments

A fair reading of the history has to grapple with several points the government could press upon rehearing, to the extent it wades into legislative history at all. The first is that the record discusses more than hostile acts. Department of Homeland Security (DHS) witnesses testified that “[v]ulnerabilities in ICT can be exploited intentionally or unintentionally.” Rep. Scott Perry (R-Pa.) recounted threats “ranging from interference by foreign adversaries to poor product manufacturing practices.” GAO listed “[f]ailure or disruption in the production or distribution of critical products” caused by “labor, trade, or political disputes” and by “earthquakes, fires, floods, or hurricanes.”

In context, though, the unintentional items are still framed as openings that hostile actors exploit for nefarious purposes. DHS’s list of the means of exploitation is “deliberate mislabeling and counterfeits, unauthorized production, tampering, theft, and insertion of malicious software or hardware.” GAO’s discussion of “unintentional vulnerabilities” explains that “[c]yber attackers may focus their efforts on ... finding and exploiting existing defects.”

The majority’s reading of “manipulate,” by contrast, implicates a great deal of ordinary conduct. To “arrange, operate, or control” a product “in a skillful manner” describes almost every decision a technology company makes. A software company that stops issuing security patches for an older operating system has deliberately controlled that product’s “retirement,” one of the life cycle stages the statute lists, and the result is to “deny” agencies its continued use. A vendor that declines to build a feature an agency requested has made a deliberate choice about the product’s “design” that denies the government a function it wanted. These are routine business decisions, yet on the majority’s reading each one may expose an actor to being labeled a supply chain risk.

The government may respond that FASCSA’s other requirements screen out cases like these. An agency must find a “significant” supply chain risk and determine that excluding the vendor is “necessary to protect national security.” But those are judgment calls, and the majority reviewed them deferentially. What’s more, such an open-ended definition of supply chain risk could foreseeably result in the government using the threat of labeling a vendor such a risk as a means to inappropriately steer and strong-arm corporate activity in myriad domains.

The government may also point to two passages in the Senate report that seem to favor the panel’s focus on effects over intent. The report notes that compromised products “could be modified to perform below expectations or fail.” It also says of those targeting federal systems: “The actors' motivations vary, but the effects are the same: a less secure America.” Neither passage helps the government once it is read in context. The first concerns products compromised as they move through the supply chain, and the committee’s source for it was a report on supply chain vulnerabilities from China.

The second passage comes closer to the panel’s reasoning, but only when it is lifted out of its paragraph. The sentence immediately before it says that federal technologies “either could be or already have been targeted by bad actors or hostile nation states.” Those are the “actors” whose “motivations vary.” The footnote attached to the sentence provides better insights into what the committee likely meant. It quotes the House Intelligence Committee’s warning that Chinese implants could let Beijing “shut down or degrade critical national security systems in a time of crisis or war,” could serve as “a potent espionage tool,” and could help China obtain “an unfair diplomatic or commercial advantage over the United States.” A hostile government might compromise federal systems to win a war, to steal secrets, or to gain leverage in a negotiation. Whatever the reason in a given case, the damage to the United States would be the same. That is the point the committee was making. It said nothing to suggest that someone with no hostile purpose, such as a vendor enforcing a disclosed, contractual usage policy, belongs on that list.

Finally, the government may lean on a principle the majority invoked: In national security statutes, courts “construe ambiguities ... in favor of the government.” That presumption only matters, however, if the ordinary tools of interpretation leave the question open. Read alongside its history, this definition does not. The record also shows that Congress expected this authority to be powerful and built limits around it for that reason. DHS’s chief procurement officer, testifying for the agency that was asking for new exclusion authority, told Congress she supported “strong safeguards against the abuse of any authorities granted.” The Senate committee designed judicial review to give “aggrieved companies” due process and sent those cases to the D.C. Circuit specifically. A presumption that settles every question about the definition’s scope in the executive’s favor would render that review meaningless on the question that matters most: what counts as a supply chain risk.

Conclusion

The legislative history cannot decide this case on its own. What it can do is answer the question the panel treated as settled by a dictionary: What kind of manipulation did Congress have in mind? The sources discussed here all point in the same direction: Congress was concerned about back doors, malicious implants, counterfeit parts, and vendors that a hostile government might press into service. It wrote a definition to capture that kind of conduct. Anthropic told the department in writing what Claude would not do, negotiated over those limits for months, and loosened many of them along the way. Whatever one thinks of the company’s position, that conduct bears no resemblance to the threat Congress described. If the full court grants rehearing, it should give that history the attention the panel majority did not.

Disclosure: Anthropic supports an unrelated Lawfare project with compute and access to Claude. The company has no role or involvement in Lawfare’s editorial process.