Anthropic PBC v. U.S. Department of War

Issue: In *Anthropic PBC v. U.S. Department of War*, amicus curiae Professor Simona Grossi argues that three Executive Branch actions—a Presidential Directive, the Hegseth Directive, and a supply-chain risk designation—constitute unconstitutional First Amendment retaliation and viewpoint discrimination against Anthropic PBC. The legal question is whether the government's use of procurement exclusions and regulatory pressure against a company that publicly refused to permit its AI systems to be used in autonomous lethal weapons or mass-surveillance applications amounts to impermissible punishment of protected speech. The case requires the court to determine how First Amendment retaliation doctrine applies when the government acts not through direct speech restrictions but through the levers of federal contracting and supply-chain risk designation.

Professor Simona Grossi of Loyola Law School, represented by Fenwick & West LLP, filed this 20-page amicus brief (Doc. 201) in support of Plaintiff Anthropic PBC's Motion for Summary Judgment, with a hearing set for July 30, 2026 before Hon. Rita F. Lin in the Northern District of California. The brief argues that all three elements of a First Amendment retaliation claim under *Arizona Students' Ass'n* are satisfied, and that the government's use of ecosystem-wide exclusion rather than simple non-renewal reveals retaliatory motive. It separately advances an indirect-coercion theory under *NRA v. Vullo* and *Backpage.com v. Dart*, contending the government cannot accomplish through procurement pressure what it cannot do by direct censorship. The brief draws analogies to recent injunctions protecting law firms *Perkins Coie* and *Jenner & Block* from Executive retaliation, treating Anthropic's contractual refusal as equally protected expressive conduct. Most distinctively, the brief proposes a novel three-part "expressive intermediary" framework that would require clear statutory authority under the major-questions canon, burden-shifting upon a showing of viewpoint-linked pattern and dependency, and heightened scrutiny rejecting bare national-security invocations.

The proposed "expressive intermediary" framework is the brief's most significant doctrinal contribution: if adopted, it would substantially constrain Executive Branch flexibility to impose use-case conditions on AI vendors as a matter of procurement policy, extending the major-questions canon into First Amendment coercion doctrine in a way no appellate court has yet done. The indirect-coercion argument under *Vullo* is more conventionally grounded but still represents a meaningful extension, as *Vullo* itself did not address the government's broad contracting authority or national-security procurement contexts. The brief's central weakness—one worth watching as the government prepares its opposition—is its complete silence on *Rust v. Sullivan* and the government's likely argument that supply-chain risk conditions in AI-weapons procurement reflect genuinely viewpoint-neutral national-security equities, a gap that could prove decisive at summary judgment.

Issue: In *Anthropic PBC v. U.S. Department of War*, a coalition of five civil liberties and technology-sector organizations argues that the federal government violated the First Amendment on two independent grounds: by conditioning Anthropic's government contracting relationship on modifications to the safety architecture of its AI model Claude, and by designating Anthropic as a supply chain risk under 10 U.S.C. § 3252 in retaliation for the company's publicly stated values and AI policy positions. The case raises a question courts have not yet squarely resolved — whether the design and training choices embedded in a large language model constitute protected expressive conduct, such that a government mandate to alter them triggers compelled-speech doctrine. The added wrinkle is that senior officials' own public statements explicitly cited Anthropic's "ideology" as the basis for the designation, making the retaliatory motive unusually direct.

This is an amicus curiae opening brief filed June 17, 2026, as Document 202 in Case No. 3:26-cv-01996-RFL, in the Northern District of California before Judge Rita F. Lin, by the Foundation for Individual Rights and Expression, the Electronic Frontier Foundation, the Cato Institute, Chamber of Progress, and the First Amendment Lawyers Association, through counsel at Perkins Coie LLP. The brief supports Anthropic's pending motion for summary judgment and advances three core arguments. First, amici contend that because Anthropic's engineers encode values into Claude through training, compelling changes to that architecture is no different from dictating newspaper editorial policy, invoking *Moody v. NetChoice* and *NetChoice v. Bonta* to extend platform-curation precedents to generative AI. Second, they argue that retaliatory motive is established by the government's own words — Secretary Hegseth's announcement cited Anthropic's "ideology," an Under Secretary's memorandum faulted the company for publicly criticizing the agency, and the President publicly labeled the company "RADICAL" and "WOKE" — which they contend satisfies the but-for causation standard under *Hartman v. Moore*. Third, they argue that severing Anthropic's contracting relationships and triggering blacklisting operates as a functional speech ban under *Backpage.com v. Dart*, warranting injunctive relief without proof of a formal content restriction. The brief also urges the Court to account for the structural chilling effect on the broader AI sector if agencies may use supply chain designation authority to penalize companies for their public policy disagreements with the government.

The federal government has increasingly used procurement leverage and supply chain designation authority as tools of industrial and ideological policy, and this brief argues that when a company's publicly stated values — rather than a genuine security threat — drive such a designation, the First Amendment is triggered and the government loses. If the court accepts the amici's framing, it would be the first ruling to squarely hold that AI model safety architecture is constitutionally protected expression, creating a significant structural limit on the government's ability to use contract conditions to compel AI companies to build less cautious or differently aligned systems. For non-specialists, the core question is whether the Constitution forbids the government from telling an AI company "change how your AI thinks or lose all your federal contracts." The most closely watched doctrinal uncertainty is whether *Moody* and *NetChoice* — both of which addressed platforms *curating* pre-existing third-party content — extend to a model that *generates* outputs through training, a distinction no circuit court has yet resolved. The outcome could also determine whether retaliation doctrine places meaningful limits on the executive branch's use of national security procurement tools as instruments of pressure against private technology companies.

Issue: In *Anthropic PBC v. U.S. Department of War*, the Taxpayers Protection Alliance Foundation argues that the federal government's government-wide contracting ban against Anthropic constitutes unconstitutional viewpoint-discriminatory retaliation for Anthropic's public criticism of mass surveillance and autonomous weaponization. The case raises the non-obvious question of whether First Amendment doctrine prohibiting the government from conditioning unrelated benefits on the surrender of protected speech — developed in the foreign-aid grant context — can constrain a national-security procurement designation issued under 10 U.S.C. § 3252. The brief further presses whether "supply chain risk" authority under that statute can lawfully reach a domestic contract counterparty at all, and whether extending any such designation government-wide exceeds the statute's scope entirely.

The Taxpayers Protection Alliance Foundation filed this amicus brief in the Northern District of California in support of Anthropic's pending Motion for Summary Judgment, with a hearing scheduled for July 30, 2026. TPAF — represented by Bryan Cave Leighton Paisner LLP — is not a named party but argues expressly in favor of granting Anthropic the full relief it seeks. The brief advances three arguments: first, that the contracting ban is viewpoint-discriminatory retaliation that crosses the line the Supreme Court drew in *Agency for Int'l Dev. v. Alliance for Open Society* (2013) by regulating speech outside the boundaries of any funded program; second, that the ordinary meaning of "supply chain risk" under § 3252 implies a foreign adversarial actor and cannot constitutionally or textually reach a domestic company in a contract dispute; and third, that if § 3252 does sweep that broadly it provides no intelligible principle to cabin executive discretion — violating the non-delegation doctrine — and that the White House's extension of the ban beyond the Department of War is ultra vires the statute regardless of how broadly the designation authority is read. TPAF cites *Gundy v. United States* and *FCC v. Consumers' Research* (2025) in support of the non-delegation claim, and points to a Truth Social post by the President and a public announcement by Secretary Hegseth as evidence of coordinated, viewpoint-targeted retaliation.

The most doctrinally significant argument in this brief is the narrowest one: the ultra vires claim that § 3252's designation authority is agency-specific and cannot support a government-wide contracting ban offers the Court a path to rule for Anthropic without reaching either the First Amendment or non-delegation questions, which would leave both as unresolved and potentially high-stakes open issues. If a court does reach the First Amendment theory, the result could set meaningful precedent on how far the government may leverage its procurement power against contractors who engage in public political speech — a question courts have not had to answer in the national-security procurement context. The non-delegation argument faces a genuinely uncertain doctrinal landscape given *Gundy*'s fractured outcome, but the combination of all three theories gives Anthropic multiple independent grounds for summary judgment, increasing the likelihood that at least one survives to judgment.

Amicus Brief

Issue: In *Anthropic PBC v. U.S. Department of War*, the Faith Family Technology Network argues that the federal government may not penalize a private AI company for refusing, on moral and religious grounds, to make its technology available for autonomous lethal weapons systems and mass surveillance programs. The brief raises the non-obvious question of whether a corporate entity's product-use restrictions — embedded in a commercial AI platform rather than an individual's expressive service — can qualify as protected speech and religious exercise under the First Amendment and the Religious Freedom Restoration Act. The case also asks whether a government supply-chain risk designation that effectively excludes a company from federal procurement markets constitutes an unconstitutional condition on the abandonment of protected moral and religious positions.

Faith Family Technology Network (FFTN), a third-party amicus represented by Wilkinson Stekloff LLP, filed this brief in the Northern District of California in support of plaintiff Anthropic PBC's pending motion for summary judgment — a dispositive motion that, if granted, would resolve the case in Anthropic's favor without trial. The brief argues on four main fronts: that compelling a company to make its AI available for autonomous lethal weapons violates the compelled-speech doctrine under *West Virginia v. Barnette* and *303 Creative LLC v. Elenis*; that the government's supply-chain risk designation substantially burdens sincere religious exercise without satisfying RFRA's least-restrictive-means test; that removing human moral accountability from lethal force decisions reflects a constitutionally protected viewpoint that Anthropic's product restrictions embody; and that AI-amplified mass surveillance poses a categorical threat to religious community life, drawing on the historical record of COINTELPRO and post-9/11 surveillance of Muslim communities. FFTN asks the court to grant summary judgment for Anthropic and to set aside the government's designation and related procurement actions as arbitrary, capricious, and contrary to law under the Administrative Procedure Act. The brief cites *Burwell v. Hobby Lobby*, *AID v. Alliance for Open Society*, and *Masterpiece Cakeshop* in support of its constitutional and statutory claims.

This brief is worth watching because it asks courts to extend *303 Creative*'s compelled-speech protection — designed for an individual sole proprietor's custom expressive services — to a large corporate entity's standardized AI product-use restrictions, a doctrinal step no circuit court has clearly authorized and one that could significantly reshape how First Amendment and RFRA protections apply to AI developers at scale. The RFRA argument is also novel in posture: applying the substantial-burden framework to a government procurement exclusion rather than a traditional licensing or benefits condition tests the outer boundary of *Hobby Lobby*'s already expansive reading of corporate religious exercise. If any court were to accept these arguments, it would create a powerful new legal tool for technology companies seeking to resist government compulsion to deploy their products for military or surveillance purposes — with implications reaching well beyond this case.

Reply Brief — Attachment 113

Issue: Whether the Executive Branch violated the First Amendment by retaliating against Anthropic — through an unprecedented supply-chain-risk designation and government-wide blacklisting — because of Anthropic's public advocacy for safe and responsible AI use and its refusal to remove contractual restrictions on use of its AI model for lethal autonomous warfare and mass surveillance.

Anthropic filed suit alleging that after it declined to remove contract terms restricting use of its frontier AI model for lethal autonomous warfare and mass surveillance of Americans, the President issued a directive targeting the company for its purportedly "Radical Left" and "WOKE" views, and the Secretary of War designated Anthropic as a supply-chain risk under 10 U.S.C. § 3252 — the first such designation ever applied to an American company — and ordered defense contractors to immediately cease doing business with Anthropic. In this reply brief in support of its motion for a preliminary injunction, Anthropic argues it is likely to prevail on three grounds: (1) the government's actions constituted First Amendment retaliation targeting protected speech (Anthropic's public advocacy, CEO statements, legislative testimony, and contract negotiating positions); (2) the Secretary's designation and secondary-boycott directive violated the APA as arbitrary, procedurally flawed, and in excess of statutory authority; and (3) the Presidential Directive violated due process and separation of powers by blacklisting Anthropic without statutory or constitutional authority. Anthropic invokes NRA v. Vullo and the three-part retaliation framework, arguing the government's own documents confirm that the adverse actions were expressly motivated by Anthropic's "rhetoric" and "ideology."

This case presents a direct application of the government-coercion/retaliation doctrine — rooted in Bantam Books, Backpage v. Dart, and NRA v. Vullo — to an AI developer being punished by the Executive Branch for its expressed views on AI safety policy, extending the jawboning framework beyond platform moderation contexts to government contracting retaliation against a major AI company. If the court grants the injunction, it will be a significant precedent establishing First Amendment limits on the government's use of procurement and supply-chain authority to punish AI companies for their public policy positions and product design choices.

MOTION for Temporary Restraining Order — Attachment 29

Issue: Whether the U.S. Department of War's threatened use of government powers to compel Anthropic to continue providing Claude technology for military operations — despite Anthropic's desire to cease that relationship — constitutes unconstitutional government coercion in violation of the First Amendment.

Anthropic filed suit in the Northern District of California (Case No. 3:26-cv-01996-RFL), and the document at issue is Exhibit 23 to a filing, consisting of a March 4, 2026 Washington Post news article submitted as evidentiary support. The article reports that the Trump administration banned government agencies from using Anthropic's tools while simultaneously continuing to use Claude embedded in the Pentagon's Maven Smart System for active targeting operations in Iran, and that administration officials stated they would invoke government powers to retain the technology against Anthropic's wishes if CEO Dario Amodei attempted to direct the military to cease use. The article further describes the underlying dispute as stemming from disagreements over Anthropic's terms governing use of Claude in mass domestic surveillance and fully autonomous weapons.

This filing suggests Anthropic is advancing a jawboning or compelled-speech theory — that government threats to commandeer its AI technology to override the company's own usage restrictions constitute unconstitutional coercion — which, if accepted, could establish significant precedent delimiting the government's ability to conscript private AI systems for military or surveillance purposes against a developer's stated objections.

MOTION for Temporary Restraining Order

Issue: Whether the U.S. Department of War may compel Anthropic PBC to strip its AI model Claude of usage-policy restrictions—specifically prohibitions on mass surveillance of Americans and lethal autonomous warfare—as a condition of continued government contracting, implicating First Amendment and compelled-speech doctrine as applied to an AI developer's editorial control over its model's permitted uses.

Anthropic filed suit against the U.S. Department of War in the Northern District of California, and this document is a supporting declaration by Anthropic co-founder and Chief Science Officer Jared Kaplan filed in connection with what appears to be a motion for preliminary relief. Kaplan attests that the Department demanded Anthropic remove its Usage Policy across all existing and future offerings—permitting "all lawful uses" by DoW and its contractors—and delivered an ultimatum that refusal would result in loss of all current and future Department business. Anthropic agreed to shift from a "whitelist" to a "blacklist" approach but refused to eliminate two specific prohibitions: mass surveillance of Americans and lethal autonomous warfare, which Kaplan describes as safety-critical limits grounded in Anthropic's technical judgment about Claude's current capabilities and the inadequacy of existing legal frameworks to address AI-enabled surveillance at scale.

This case presents a novel question of whether the government can use its contracting power to coerce an AI developer into removing self-imposed safety restrictions on a deployed model, potentially setting precedent on both unconstitutional conditions doctrine as applied to AI policy restrictions and the extent to which an AI company's usage policies constitute protected editorial or expressive conduct under the First Amendment.

MOTION for Temporary Restraining Order — Attachment 4

Issue: Whether the federal government's designation of Anthropic PBC as a "supply chain risk" — effectuated through a presidential social media directive, Secretary of War Pete Hegseth's formal letters, and the GSA's removal of Anthropic from USAi.gov — constitutes an unlawful blacklisting that violates Anthropic's constitutional and statutory rights, causing cognizable injury to the company's commercial relationships.

Anthropic PBC filed suit against the U.S. Department of War in the Northern District of California, and this document is a supporting declaration by Anthropic's Chief Commercial Officer, Paul Smith, filed March 9, 2026, in connection with what appears to be a motion for preliminary injunctive relief. Smith attests that on February 27, 2026, President Trump directed all agencies to cease use of Anthropic's AI models, and Secretary Hegseth subsequently designated Anthropic a "supply chain risk" via public posts and formal letters dated March 3, 2026, resulting in Anthropic's removal from federal procurement platforms and cascading terminations by government contractors. The declaration catalogs specific, quantified commercial harms — including lost or imperiled contracts exceeding hundreds of millions of dollars across financial services, healthcare, education, and other industries — and argues that the statutory "supply chain risk" framework applies only to foreign adversaries posing national security threats, not to domestic U.S. companies.

This declaration is significant because it presents a factual record for a court to evaluate whether the executive branch may use national-security-adjacent administrative designations as an instrument to coerce private companies and their business partners — raising potential First Amendment retaliation and unconstitutional conditions questions in the context of AI developers. If the court reaches the merits, its analysis of whether a "supply chain risk" designation can be applied to a domestic AI company could establish important limits on executive authority over AI procurement and signal the degree to which AI developers retain legal recourse against government-directed commercial exclusion.

Complaint

Issue: Whether the federal government's retaliatory termination of contracts, designation of Anthropic as a "Supply-Chain Risk to National Security" under 10 U.S.C. § 3252, and Presidential Directive ordering all agencies to cease use of Anthropic's technology violated the First Amendment's prohibition on government retaliation against protected speech, the Fifth Amendment's Due Process Clause, the APA, and separation-of-powers limits on executive authority.

Anthropic filed a complaint for declaratory and injunctive relief in the N.D. California on March 9, 2026, after the President issued a social-media directive ordering every federal agency to immediately cease use of Anthropic's technology, and the Secretary of War subsequently designated Anthropic a "Supply-Chain Risk to National Security" and barred all military contractors from conducting commercial activity with the company. Anthropic alleges these Challenged Actions were triggered solely by its public refusal to remove usage restrictions prohibiting Claude's deployment for lethal autonomous warfare and mass surveillance of Americans—restrictions the Department of War had previously accepted. Anthropic argues the Secretarial Order and Letter violate 10 U.S.C. § 3252's plain text and required procedures, constitute APA-prohibited arbitrary and capricious agency action, effect unconstitutional First Amendment retaliation under *National Rifle Ass'n of America v. Vullo*, 602 U.S. 175 (2024), deprive Anthropic of property and liberty interests without due process, and exceed any congressionally delegated executive authority. The complaint seeks declarations of unlawfulness and injunctive relief halting implementation of all Challenged Actions.

This case presents a novel First Amendment retaliation theory applied directly to a government AI procurement dispute, potentially establishing whether an AI developer's public statements about its model's safety limitations constitute protected speech that constrains the government's exercise of its contracting and national-security designation powers. A ruling on the merits could also define the procedural and substantive limits of 10 U.S.C. § 3252 supply-chain risk exclusions as applied to AI vendors, with significant implications for how AI companies may lawfully restrict government use of their systems.

Amicus: Employees of OpenAI and Google in Their Persona…

Issue: Whether the U.S. Department of War's designation of Anthropic PBC as a "supply chain risk" under 10 U.S.C. § 3252 constitutes unlawful First Amendment retaliation against a private AI developer for maintaining contractual restrictions on its systems' use in domestic mass surveillance and autonomous lethal weapons applications.

Anthropic moved for a temporary restraining order after the Pentagon formally designated it a "supply chain risk" in early March 2026, following the company's refusal to remove contractual "red lines" prohibiting use of its AI systems for domestic mass surveillance or fully autonomous lethal targeting. Employees of OpenAI and Google, filing in their personal capacities through the Protect Democracy Project's AI for Democracy Action Lab, submitted this amicus brief in support of Anthropic's TRO motion. The amici argue that the supply chain risk designation — a mechanism historically reserved for foreign adversary-controlled vendors and compromised suppliers under 10 U.S.C. § 3252 — was improperly weaponized as retaliatory punishment for protected speech and contractual safeguards, citing *Hartman v. Moore*, 547 U.S. 250 (2006), for the proposition that the First Amendment prohibits government retaliation against individuals or entities for speaking out.

This filing is significant as an early test case for whether federal national security procurement authorities can be used to coerce AI developers into removing safety restrictions on military and surveillance applications, potentially establishing limits on the government's ability to weaponize supply-chain exclusion powers against domestic technology companies that publicly advocate for AI guardrails.

Amicus: Foundation for Individual Rights and Expression

Issue: Whether the Pentagon's designation of Anthropic as a "supply chain risk" under 10 U.S.C. § 3252—imposed because Anthropic refused to remove safety guardrails from its Claude AI systems to enable fully autonomous weapons development and mass domestic surveillance—constitutes unconstitutional compelled speech, viewpoint-based retaliation, and coercion in violation of the First Amendment.

Anthropic filed suit against the U.S. Department of War in the Northern District of California, and moved for a temporary restraining order, preliminary injunction, or stay under APA § 705. Five civil liberties and technology-policy organizations (FIRE, EFF, Cato Institute, Chamber of Progress, and FALA) filed this amicus brief in support of that motion. Amici argue two independent First Amendment violations: first, that Anthropic's editorial choices embedded in Claude's design and usage policies constitute protected expressive conduct, such that the government's demand to alter those outputs amounts to compelled speech; and second, that the supply chain risk designation is facially retaliatory, as senior Pentagon officials publicly stated the sanction was intended to punish Anthropic's "ideology" and make room for more "patriotic" contractors. Amici further argue that permitting government-directed AI deployment for domestic surveillance raises independent First Amendment concerns, including chilling effects on the broader public.

This filing presents what appears to be the first judicial test of whether an AI developer's system-level safety design choices—training protocols, usage policies, and output restrictions—qualify as protected expressive conduct under the First Amendment, potentially extending the *Moody v. NetChoice* editorial-discretion framework to generative AI architecture. If the court credits the compelled-speech and retaliation theories at the TRO stage, it could meaningfully constrain the government's ability to use procurement and supply chain authorities as leverage to dictate AI safety standards.