"The empty invocation of national security is not a blank check to punish and retaliate against government critics."  

Anthropic PBC v. U.S. Department of War, No. 26-cv-01996-RFL (N.D. Cal. Aug. 27, 2026) (Lin, J.)

Bedrock constitutional principles were in play in last week's district court ruling in Anthropic's epic legal battle against the U.S. Department of War. On August 27, 2026, Judge Rita F. Lin of the Northern District of California entered final judgment for Anthropic and vacated the Department's designation of the company as a supply chain risk to national security, holding, on a completed administrative record, that the government retaliated against Anthropic for criticizing it. The 59-page opinion and the accompanying order of final relief in Anthropic PBC v. U.S. Department of War, No. 26-cv-01996-RFL, convert the March preliminary injunction into a permanent one and refuse the government even the short administrative stay it requested. For technology vendors in the federal supply chain, the decision draws the clearest limit yet on government reprisals for speaking out about how a vendor's technology should be used.

What the Court Decided

Judge Lin granted summary judgment to Anthropic on three grounds, each of which would support the relief on its own. She held that the Presidential Directive, the Hegseth Directive, and the resulting supply chain designation were unlawful retaliation in violation of the First Amendment, that the government imposed what amounted to a permanent debarment without the pre-deprivation notice and hearing the Fifth Amendment requires, and that the designation exceeded the Secretary's authority under 10 U.S.C. § 3252 while also being arbitrary and capricious under the Administrative Procedure Act. Anthropic did not win everything though. The court rejected its ultra vires separation of powers theory under Dalton v. Specter and entered judgment for the agencies that took no action or only interim steps.

The factual finding underneath all three holdings is that the government's technical rationale collapsed once the record was assembled. The entire justification for the designation, Judge Lin found, was a four-page memorandum from Under Secretary Emil Michael that postdated two of the three challenged actions and rested on a premise the government later abandoned: that Anthropic retained backdoor access to its models after deployment. Because Anthropic "undisputedly lacks any such access" and its technology is, as the government conceded, "no riskier to the national security than any other 'black box' artificial intelligence model," the only remaining rationale unique to Anthropic was the government's asserted loss of "trust."

The Quote of the Day

The sentence that will travel furthest closes the decision's introduction: "The empty invocation of national security is not a blank check to punish and retaliate against government critics." The court reached that conclusion while expressly acknowledging that "[t]he government is certainly owed deference on weighty issues of national security," which is what makes the finding on motive so pointed. Judge Lin wrote that the government's "contemporaneous words and deeds confirm that the challenged actions were based on a desire to make a public example out of Anthropic for its 'arrogance' in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model." 

The opinion lands on a familiar suspicion that "national security" is most likely to be invoked as a justification precisely when the contemporaneous record offers no other one. Judge Lin's method of crediting the deference the government is owed, then testing it against the agency's own words and timing, shows how courts separate a reasoned security judgment from a label reached for after the fact.

Three further passages matter for anyone negotiating federal technology agreements: 

1. On the constitutional limit: "Neither the Constitution nor the federal statute invoked by Defendants allows them to impose sweeping penalties based principally on Anthropic's critique of the Administration's views." 
2. On the boundary between commercial preference and legal sanction: "Though the Department of War is undisputedly free to select the AI vendor of its choice, the evidence demonstrates that the broad measures imposed on Anthropic were illegal and baseless." 
3. And on the reach of the statute itself: "An IT vendor does not become a potential adversary of the United States whenever it asks probing questions or stubbornly insists on particular contracting terms, even if doing so causes DoW to doubt its trustworthiness," because permitting the Secretary "to affix that label to suppliers simply because he deems them too arrogant or difficult to 'trust' would effectively gut that statutory requirement."

The Scope of the Order

Read from the contractor's side of the table rather than the court's, the relief order clears away three distinct obstacles. It vacates and sets aside the § 3252 supply chain designation itself under 5 U.S.C. § 706(2). It vacates the separate directive clause whose reach went past federal contracting altogether, the one that had forbidden companies in the defense supply chain from doing business of any kind with Anthropic, including business having nothing to do with a government contract. And it vacates the implementing orders that nine agencies issued to carry out the Presidential Directive, with the remaining defendants permanently enjoined, directed to rescind the guidance and instructions they had issued, and left subject to the court's retained jurisdiction to enforce compliance.

What the order does not do is hand Anthropic a customer. Paragraph 14 draws the line the government will rely on going forward, and it leaves the Department free to decline Anthropic's products or to move to another provider by lawful means. For a company weighing what actually changed, the distinction worth holding onto is between a restriction that followed Anthropic into commercial dealings it had no federal nexus to, which is gone, and an ordinary procurement preference exercised contract by contract, which is not.

What Remains Unanswered

This ruling does not clear the field. The Department issued two designation letters in March, and only the § 3252 letter was before Judge Lin. The parallel designation under 41 U.S.C. § 4713, the Federal Acquisition Supply Chain Security Act (FASCSA) provision that reaches the entire federal procurement system, went on direct review to the D.C. Circuit, which denied a stay in April and heard argument on May 19. On June 24 the panel granted Anthropic's consent motion to consolidate a second petition, No. 26-1162, and set a supplemental briefing schedule that ran until August 3, with Circuit Judge Henderson recorded as “would deny” on the supplemental briefing. The case has therefore been fully submitted for less than a month, and no merits decision has issued. That designation remains in effect, and the San Francisco judgment does not reach it. Reporting from the government contracts bar through the summer has described certification requests arriving at contractors under the FAR supply chain clauses without consistent scope or wording from one contracting office to the next, which means a company cannot safely assume that the answer it gave on one contract is the answer another customer is asking for. We covered that two-track structure in Two Courts, Two Postures and in One Government, Two Voices, and it is now where the remaining risk sits.

The Appellate Map After Judgment

The appellate map has an unusual interlock that final judgment does not undo. The government's appeal from the March preliminary injunction sits in the Ninth Circuit as No. 26-2011, where it has been dormant since April 27. That day the court held the appeal in abeyance at the parties' joint request, and its order directs that appellants "file a motion for appropriate relief within 21 days after resolution" of the DC Circuit case, No. 26-1049. The same order preserves either side's right to move to lift the stay at any time, so the abeyance is a convenience the parties can withdraw from rather than a fixed schedule. The August 27 judgment likely overtakes that appeal, because the preliminary injunction has merged into a permanent one and no interlocutory order remains to review. The government's path back to the Ninth Circuit is therefore a fresh notice of appeal from the judgment itself, within the 60 days allowed under Rule 4(a)(1)(B) of the Federal Rules of Appellate Procedure. Nothing pauses in the meantime, because an appeal does not by itself stay an injunction and Judge Lin has already refused an administrative stay on the ground that the government identified no harm after more than five months of compliance. The two tracks are already speaking to each other. Anthropic filed letters under Rule 28(j) of the appellate rules advising the DC Circuit of additional authorities on August 19 and again on August 28, the day after final judgment, and the government responded in between on August 26. The practical effect is that one panel in Washington now sets the pace for both cases.

Bottom Line

• Public advocacy stays protected inside a contract fight. The court held that speech about the limits of military and surveillance AI is a matter of public concern that does not lose protection because it also happens to be a negotiating position.
• A security label is not self-justifying. The designation failed on the record rather than on the law. There was no articulable basis in it, no reasoned determination on the point the regulation requires an agency to reach before passing over less intrusive measures, and no risk assessment from the official the regulation names.
• Check both designations before you certify. The FASCSA designation survives this judgment, so certification requests flowing down through defense primes still require a contract-by-contract answer rather than an enterprise-wide one.

For questions about supply chain risk designations, compliance in government contracting, or acceptable-use terms in federal AI agreements, please contact the Jones Walker Privacy, Data Strategy and Artificial Intelligence team. Stay tuned and subscribe for continued insights from the AI Law and Policy Navigator.