Anthropic asks full D.C. Circuit to rehear Pentagon case

Anthropic has asked all active judges of the D.C. Circuit to rehear the case in which a panel let the Pentagon label it a “supply chain risk.” In an October 17 analysis for Lawfaremedia, the author argues that if the petition is granted, the court should look at the record Congress left behind when it wrote the 2018 law. Read that way, the analysis says, the decision would “likely” be reversed.

The piece discloses that Anthropic supports an unrelated Lawfare project with compute and has no role in its editorial process.

The ruling under challenge came from Judge Gregory Katsas, joined by Judge Neomi Rao, and upheld the exclusion under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). Its reasoning rests on two words in the statute’s definition, “otherwise manipulate.” For their meaning the majority went to the American Heritage Dictionary: ”[t]o move, arrange, operate, or control by the hands or another body part or by mechanical means, especially in a skillful manner.” On that reading, the panel saw no need for bad intent. Judge Karen LeCraft Henderson dissented, describing the conduct the holding reaches as “a contractor’s honest and upfront enforcement of restrictions on a covered article’s use disfavored by the government.”

What Anthropic is actually fighting

Anthropic is not asking to stay in the Pentagon’s systems. It does not contest the department’s right to stop using Claude on covered projects, and it offered to help the department move to another provider without disruption. What it objects to is the label. It wants the department to follow ordinary procurement law and says “supply chain risk” is a term associated with malicious actors.

The dispute started in contract talks early in 2026. The department wanted Claude available for “all lawful use.” Anthropic refused to allow domestic mass surveillance or fully autonomous weapons systems, and talks broke down over those two limits. Pete Hegseth announced his intent to remove Anthropic from the federal supply chain in a social media post on February 27, then formally invoked FASCSA on March 3. The determination called continued use of Claude a “significant supply chain risk,” gave department systems 180 days to remove Anthropic products, and barred defense contractors from using Claude in department-related work. Both Mayer Brown and the Guardian describe it as the first time an American company has been publicly given this designation.

Because the Pentagon relied on two separate statutes, Anthropic had to sue in two courts. In San Francisco, District Judge Rita Lin dealt with the older Defense Department authority, 10 U.S.C. § 3252, and found that the government had retaliated against Anthropic in violation of the First Amendment. “The empty invocation of national security is not a blank check to punish and retaliate against government critics,” Lin wrote, per the Guardian. The FASCSA challenge went straight to the D.C. Circuit, which is where Congress sent such cases. The rehearing petition is the next step in that track.

Two sentences on the history

The FASCSA definition calls a supply chain risk the risk that “any person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate” a covered article across its life cycle, from design to retirement, “so as to surveil, deny, disrupt, or otherwise manipulate” its function or use.

Lawfare’s core complaint is that the majority read that clause like a dictionary entry, while the Supreme Court has asked for more. In <em>Fischer v. United States</em>, another case about how far an “otherwise” clause reaches, Chief Justice John Roberts wrote that “the Court must decide how it is linked to its ‘surrounding words,’” and the Court then checked its narrower reading against the problem Congress was solving. The D.C. Circuit majority’s treatment of FASCSA’s legislative history, by contrast, runs to only two sentences. One rejects reading the law as limited to “foreign companies working at the behest of foreign states,” because “any person” cannot mean only foreign entities. The other dismisses, without elaboration, the dissent’s use of the history to find the ordinary meaning of the definition’s verbs.

The analysis concedes the first point. Nothing in FASCSA limits the label to foreign actors. The question it presses is which conduct qualifies, and there the committee reports, hearings and floor statements describe one kind of problem: someone, foreign or domestic, inside a vendor or outside it, covertly compromising technology the government buys.

The Senate committee report on S. 3085, the bill that became FASCSA, opens its statement of need with: “Hostile nation states and other bad actors are attempting to gain unprecedented access to sensitive and classified information via the Federal Information and Communications Technology (ICT) supply chains.” Its examples are Kaspersky Lab, Huawei and ZTE. In the Kaspersky case, the government never had to prove the vendor itself was hostile. The worry, as then-Acting Homeland Security Secretary Elaine Duke put it, was that “the Russian government, whether acting on its own or in collaboration with Kaspersky,” could use the access Kaspersky’s products gave it. Rep. Kathleen Rice said at a July 2018 House hearing that “the FBI had reason to believe the Kaspersky programs contained back doors that could be accessed by Russian intelligence.”

Lawfare reads “any person” through that lens. The risk can come from whoever is positioned to exploit a product, but in every version someone is trying to compromise federal systems without the government knowing. The closest the record comes to Anthropic’s situation is Rep. Peter King describing entities that “become trusted vendors, and then steal from or otherwise harm” the homeland security enterprise. Even there, trusted status is cover for theft. Anthropic’s limits were written into contracts, negotiated over months and explained in public by its CEO. The majority itself notes that the company “partially—but not completely—relaxed its use restrictions,” building a government-specific model and a government-specific usage-policy addendum.

Where “manipulate” came from

The statute’s wording has a lineage, and Lawfare traces it through three texts:

• 2011, Section 806 (now 10 U.S.C. § 3252): the risk that “an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert” a covered system “so as to surveil, deny, disrupt, or otherwise degrade” it.
• Summer 2018, H.R. 6430: “an adversary” becomes “a malicious actor,” “extract or modify data” is added, and “manipulate” replaces both “subvert” and “degrade.”
• December 2018, FASCSA: “extract or modify data” is trimmed to “extract data,” and “a malicious actor” becomes “any person.”

So “otherwise manipulate” first appeared in a bill aimed explicitly at malicious actors, and its managers presented it as a continuation of the 2011 authority. King told the House it “is modeled after existing authority granted to the Department of Defense in 2011.” The Northern District of California read that 2011 definition to require bad motive.

The hearing transcripts also show how the word was used in the room. GAO’s Gregory Wilshusen warned that threats could let “adversaries to take control of systems, extract or manipulate data, or decrease the availability of resources,” a phrase that closely tracks the enacted “extract data, or otherwise manipulate.” The one neutral use of the word in the record is GAO quoting the standard definition of information technology: equipment used in the “automatic acquisition, storage, manipulation, management, movement, control ... of data or information.” FASCSA builds that definition into what counts as a covered article. If handling data in that sense were enough to create a supply chain risk, every product the government buys would be one.

The government’s likely answers

The analysis expects several counterarguments. The record does mention unintentional failures: DHS witnesses testified that ICT vulnerabilities “can be exploited intentionally or unintentionally,” and GAO listed disruptions from labor disputes and from “earthquakes, fires, floods, or hurricanes.” Lawfare’s reply is that these appear as openings hostile actors exploit. DHS listed the means as “deliberate mislabeling and counterfeits, unauthorized production, tampering, theft, and insertion of malicious software or hardware.”

The Senate report also says the attackers’ “motivations vary, but the effects are the same: a less secure America.” Read in context, the actors whose motives vary are the “bad actors or hostile nation states” named in the sentence before. The footnote is about Chinese implants that could let Beijing “shut down or degrade critical national security systems in a time of crisis or war.”

The government can also point to FASCSA’s other hurdles: the risk must be “significant” and exclusion “necessary to protect national security.” Lawfare notes the majority reviewed those judgment calls deferentially, and argues that under its definition routine decisions come within reach. A vendor that stops patching an old operating system has controlled the product’s “retirement” and denied agencies its use. A vendor that declines to build a requested feature has made a “design” choice. The analysis warns that a definition this open could let the government use the threat of the label to steer companies far beyond defense procurement.

Finally, the majority invoked the rule that ambiguities in national security statutes are resolved “in favor of the government.” Lawfare argues the rule applies only if the ordinary tools leave the question open, and that Congress expected this power to need limits. DHS’s chief procurement officer told Congress she supported “strong safeguards against the abuse of any authorities granted,” and the Senate committee designed D.C. Circuit review to give “aggrieved companies” due process.

That argument works only if the definition requires hostile conduct, and on the facts the panel has already given ground. The majority wrote that it had “no reason to doubt” Anthropic’s “noble intentions,” and “no quarrel” with the California court’s finding that the company “has acted with no such bad motive in its dealings with the Department.”