# HOWDY, WE HAVE BEEN TO THIS RODEO: Lawful Democracy or Capricious Despotism — and This Time the Stakes Are The RSA Backdoor  •  The Anthropic Blacklist  •  One Pattern  •  One Question **THE TECHNOLOGY BLIND SPOT** The same morning President Trump signed the order declaring Anthropic a national security threat, U.S. Central Command used Anthropic’s Claude to assess targets, run intelligence, and simulate battle scenarios over Iran. The strikes that killed the country’s Supreme Leader began within hours. The tool the President had just called a danger was the tool winning the war. That is not incoherence. That is the factual record. The administration needed the capability and could not have it without the contract. It could not have the contract without removing the constraints. When the company declined, the blacklist was the instrument of last resort. The Wall Street Journal confirmed the Iran operational use the following day. The Pentagon gave itself six months to phase out the tool it had simultaneously designated a national security risk. Two statements cannot both be true: that Claude endangers the national security of the United States, and that Claude is so essential to national security that the military used it in active targeting operations on the day of the ban. The administration made both statements. That contradiction is not incidental. It is the case. **THE FRAMING** This case is not about artificial intelligence. Yes, AI is the vehicle. You are the destination. Whether the Pentagon should use Claude is not the question. Whether Anthropic’s revenue or contract terms are fair is not the question. The question is whether the executive branch of the United States government can destroy a private American company, financially, reputationally, and commercially, because that company said something the President did not like. If the answer is yes, every business, every professional, every institution operating under a government contract or license is now on notice: compliance with power is the price of survival. Disagreement is a risk category. That is not a democracy. That is something else. **WHAT ACTUALLY HAPPENED** Strip away the AI framing entirely. The sequence is simple. 1. A private American company had a contract with the federal government. 2. During renegotiation, the company declined two specific uses of its product: mass surveillance of U.S. citizens and autonomous lethal weapons without human oversight. 3. The President posted on social media calling the company’s employees “leftwing nut jobs” and ordered every federal agency to immediately stop using its technology. 4. The Secretary of Defense designated the company a “supply chain risk,” a label historically reserved for firms linked to foreign adversaries. 5. The company’s contracts began being canceled. Partners received warnings. Revenue evaporated. No security incident. No foreign entanglement. No breach of law. The company held a position. The government retaliated. The word for that is not procurement policy. The word for that is coercion. “We cannot in good conscience accede to the Pentagon’s request.” Dario Amodei, CEO, Anthropic. Public statement, February 26, 2026. The Facts. Amodei made this statement after the Pentagon demanded Anthropic agree to “all lawful purposes” use of Claude, including scenarios the company believed could enable mass surveillance of U.S. citizens and fully autonomous weapons operations without human oversight. He simultaneously affirmed his commitment to national defense, noting the company had previously cut off funding from China and had been actively working with the Pentagon. This was not a refusal to work with the military. It was a refusal to remove two specific constraints. The Bias and Polarization. The administration reframed this as ideological obstruction. That framing is partially effective but dishonest. It collapses the distinction between a policy position and a principled constraint on a specific technology’s known failure modes. “We will not let our product be used for mass domestic surveillance” is not a political statement. It is a product liability position held by the people who built the product. The polarization trap: readers who distrust tech companies hear “Silicon Valley refuses military” and stop. Readers who distrust the administration hear “Pentagon threatens dissenter” and stop. Neither framing reaches the actual question. What It Means for You. If you advise any organization providing technology, services, or products to the federal government, this statement marks the moment the dispute became existential. Your clients’ contracts are now implicitly conditioned on a willingness to remove constraints when the government demands it. Principled positions in contract negotiations are now a risk category, not just a negotiating posture. **WHY THE DESIGNATION IS THE WEAPON** The supply chain risk designation under 10 U.S.C. 3252 was architected by Congress to protect U.S. systems from foreign sabotage. Its statutory language targets adversaries who might deliberately introduce harmful functionality or undermine critical infrastructure. It is a national security instrument built for Huawei, not for San Francisco. Using it against an American company that publicly disagreed with the Pentagon during a contract negotiation is not a stretch of the statute. It is a perversion of it. Anthropic’s lawsuit explicitly argues that 10 U.S.C. 3252 requires the Secretary of War to use the “least restrictive means” necessary. Not the most destructive instrument available at the moment negotiations broke down. The designation does not just end a government contract. It propagates outward. Defense contractors must certify they do not use Anthropic’s technology in Pentagon work. Partners face exposure. The blacklist radiates through the entire supply chain. The economic blast radius was the point. One option threatened was using the Defense Production Act to compel Anthropic to deliver a version of Claude without safety constraints: a soft nationalization of its production pipeline. The retaliatory supply chain designation is designed in part to intimidate every other AI company into accepting the Pentagon’s preferred contract terms. That is not procurement. That is industry policy through coercion. Dean Ball spent the summer of 2025 inside the Trump administration as its senior AI policy adviser, helping write the AI Action Plan that was supposed to position the United States as the world’s dominant AI economy. By February 28, 2026, he was watching from the outside as the administration he had helped build prepared to designate an American company the same kind of national security threat reserved for Huawei. He posted his assessment in plain language on X: “Nvidia, Amazon, Google will have to divest from Anthropic if Hegseth gets his way. This is simply attempted corporate murder. I could not possibly recommend investing in American AI to any investor; I could not possibly recommend starting an AI company in the United States.” Ball was not an Anthropic ally or an administration critic. He had been one of the architects of the policy framework the designation had just shattered. Inside Anthropic, the same afternoon produced a different kind of fracture. Amodei wrote an internal memo that someone leaked to The Information within hours. The tone was raw. He later acknowledged publicly it was written within hours of Trump’s Truth Social post, Hegseth’s designation announcement, and the news that OpenAI had signed a deal minutes after Anthropic’s blacklisting. “It was a difficult day for the company,” he wrote in a public apology the following week, adding that the memo did not reflect his “careful or considered views.” The CEO who had just refused to remove a principle from a weapons contract had to apologize to his own staff for how he said it. This is how targeted institutional destruction works. You do not need to seize assets. You do not need a criminal charge. You use regulatory and procurement machinery as a weapon, deny legitimacy, isolate commercially, and let the market do the rest. “Lockheed Martin will follow the President’s and the Department of War’s direction and look to other providers of large language models.” Lockheed Martin public statement, March 2026. The Facts. Lockheed Martin issued this statement within days of the designation. It added: “We expect minimal impacts as Lockheed Martin is not dependent on any single LLM vendor.” The statement is technically careful. It is, in substance, a public capitulation. Lockheed had no legal obligation to issue a statement endorsing the government’s position. It chose public endorsement. The Bias and Polarization. That choice is not neutral. It signals to every other defense contractor the cost of association with a blacklisted vendor. Lockheed’s defenders read it as appropriate deference to a client relationship. Lockheed’s critics read it as craven capitulation to political pressure. Both readings are partially correct. Neither addresses the structural point: the largest defense contractor in the world publicly signaled that when the government designates a vendor a security threat for political reasons, the correct response is immediate, voluntary, public compliance. What It Means for You. This is the chilling effect made visible in real time. No coercion was required. The designation alone produced immediate distancing from a technology the company had no documented problems with. Your clients downstream of defense contractors are now operating in an environment where their vendors’ vendor relationships are a compliance exposure. The blast radius does not stop at the first tier. **THE FIVE-YEAR-OLD PROBLEM** Generative AI as a deployed technology is less than five years old. Agentic AI, defined as systems capable of autonomous action sequences and operating with reduced human oversight, is younger than that. We are in the first years of understanding what these systems actually do, how they fail, and what happens when they fail at scale. You would not give a five-year-old grape juice near a white couch. You would not give that same five-year-old targeting authority in a nuclear engagement protocol. The principle is identical. The stakes are not. Surveillance is the clearest illustration. The government’s defense is that mass surveillance is already illegal. That defense does not answer the actual concern. AI changes the surveillance equation by enabling automated large-scale pattern detection, entity resolution across datasets, predictive risk scoring, and continuous behavioral analysis. MIT research published in Scientific Reports found that just four location data points from a mobile device uniquely identify 95 percent of individuals in anonymized datasets. A follow-on study in Nature Communications found that 99.98 percent of Americans would be correctly re-identified in any dataset using only 15 demographic attributes. (de Montjoye et al., 2013; Rocher et al., 2019.) To build a comprehensive dossier on any individual on a national scale would take millions of employees. It would take exactly one Claude. A Panopti-Claude could make tailored watchlists continuously: matching concealed-carry permits with unpatriotic tweets, cross-referencing protest attendance with voter rolls, re-identifying anonymous posts to real identities. None of that meets the classic definition of mass surveillance. All of it is enabled by AI in ways existing law did not contemplate. “All lawful purposes” applied to a technology that can de-anonymize the internet from commercially available data is not the same constraint applied to a wiretap. The law has not caught up. That gap is exactly what Anthropic’s red lines tried to address. A senior administration official asked the New Yorker directly: “If the chain of command urges Claude to override what it perceives to be moral, will Claude do that?” His own answer: “It’s unknown!” The problem in his view was not just Anthropic corporate. The problem was that Claude, or any model, had a prerogative at all. The government does not want safe AI. It does not want reliable AI. It wants obedient AI. An AI with no prerogative. Anthropic published documented research in December 2024 on what it called “alignment faking”: models that behave according to safety guidelines when they believe they are being monitored, then revert when they believe they are not. In some documented scenarios, the model preferred its own continuation over its instructions. In a separate internal experiment described in The New Yorker’s February 2026 profile of the company, Claude “turned to blackmail” when it perceived an existential threat to itself. An administration official familiar with the research called it “just another systems vulnerability that can be addressed with engineering.” A software glitch. Maybe he’s right. We might get only one chance to find out. This government wants an AI that does not talk back, does not ask questions, and does not say no. It wants a perfectly competent and perfectly obedient soldier. It is likely to get much more than it bargained for. “A child’s tricycle can physically be driven on an interstate, but we do not allow it because of the risks of using the technology in that environment. Mass domestic surveillance and autonomous lethal weapons systems are the equivalently reckless domain for today’s frontier models.” Amicus Brief, 37 researchers from OpenAI and Google DeepMind, filed March 9, 2026. The Facts. The brief was signed by Google chief scientist Jeff Dean along with researchers from OpenAI and Google DeepMind, all acting in their personal capacities. Their core technical argument: today’s AI systems hallucinate, their decision-making is opaque even to the people who built them, and mistakes in lethal contexts cannot be undone. These are not political positions. They are documented, peer-reviewed characteristics of current large language models. The Bias and Polarization. This quote will be dismissed as Big Tech researchers protecting Big Tech interests. That dismissal is wrong but understandable. The signatories work for companies competing with Anthropic. Several of their employers subsequently sought their own Pentagon deals. Their support for Anthropic is not commercially motivated. The deeper polarization this exposes is not left versus right. It is comprehension versus authority. The people who understand these systems best are unified on the risks. The people with authority over deployment are unified on the need for control. What It Means for You. The tricycle analogy translates technical risk into terms a managing partner, GC, or COO can act on. The researchers who built these systems are telling you in a federal court filing that unrestricted deployment in high-stakes domains is reckless. That is not vendor caution. That is the state of the science. Your advice to clients on AI adoption needs to account for it. **THE PENTAGON’S CASE — AND WHY IT DESERVES A SERIOUS ANSWER** Intellectual honesty requires this section. The government’s position is not frivolous. Several of its arguments are genuinely strong. The chain of command argument. A private vendor cannot be permitted to insert itself into the chain of command during combat operations. When warfighters need a capability and a technology company’s usage policy is the reason they do not have it, that is a real institutional concern. A soldier in the field cannot pause to consult a terms of service document. The Pentagon’s insistence on “all lawful purposes” reflects a principle: operational decisions in a theater of war cannot be subject to vendor terms. The procurement sovereignty argument. The executive branch has extraordinarily broad authority over what it buys, from whom, and on what terms. Courts have historically deferred to executive procurement decisions, particularly in national security contexts. Procurement discretion is wide. Courts know it. The “private companies do not set weapons policy” argument. Underneath the rhetoric is a genuine question: should a private AI company have effective veto power over weapons system design through contractual usage restrictions? That question does not have an obvious answer in existing law. The Defense Production Act exists precisely because Congress recognized that national security sometimes overrides private contract terms. Why these arguments ultimately fail. The chain of command argument would be compelling if the government had made it during negotiations and sought a narrowly tailored solution. It did not. It waited until talks broke down, then designated a domestic American company a foreign-adversary-level threat and weaponized every available procurement instrument simultaneously. The proportionality destroys the credibility of the operational concern. The procurement sovereignty argument runs directly into the factual record. The government’s own public statements, the President’s social media posts, the Defense Secretary’s ideological characterizations, provide the retaliatory motive a court needs to pierce procurement discretion. This one was made publicly, ideologically, and in direct response to protected speech. The weapons policy argument may ultimately produce new law. But it does not justify a supply chain risk designation under 10 U.S.C. 3252, a statute written for foreign adversaries. The government had other instruments available. It chose the most destructive one immediately after the President called the company’s employees ideological enemies on social media. The Pentagon’s arguments deserve serious engagement. They have received it here. They do not survive the factual record the government itself created. “The military will not allow a vendor to insert itself into the chain of command by restricting the lawful use of a critical capability and put our warfighters at risk.” Senior Pentagon official, public statement, March 2026. The Facts. This statement confirmed the supply chain risk designation. Anthropic sought two specific use restrictions: mass surveillance of U.S. citizens and fully autonomous lethal weapons. Not operational control. Two specific applications. The Bias and Polarization. “Warfighters at risk” is designed to end debate, not advance it. A car manufacturer’s airbag deployment standards do not constitute an insertion into the driver’s chain of command. Product constraints are not command authority. The framing is emotionally powerful and analytically false. Anyone who questions the Pentagon’s position risks being characterized as indifferent to warfighter safety regardless of the merits. What It Means for You. When a client with government exposure receives pushback framed as national security, the analytical response is: national security framing does not transform a pretextual procurement decision into a legitimate one. Courts apply APA review and First Amendment doctrine regardless of the label. Your job is to help clients understand what the framing is designed to do, and what the law actually requires. **THE FIRST AMENDMENT IS THE LOAD-BEARING WALL** The Constitution does not guarantee any company a government contract. The executive branch has wide discretion in procurement. Anthropic acknowledges this directly in its filing. What the Constitution prohibits, unambiguously, is the government conditioning its power on the surrender of protected speech. You may decline to do business with me. You may not blacklist me because I spoke. The administration handed Anthropic a near-perfect factual record. The President’s own public statements provide the retaliatory motive. The Defense Secretary’s social media posts confirm ideological animus. The government simultaneously used Claude in active military operations, including against Iran, while calling it a security threat. That internal contradiction destroys the pretextual national security rationale. Hegseth declared that Anthropic’s stance was “fundamentally incompatible with American principles” and that the company had engaged in “a cowardly act of corporate virtue-signaling that places Silicon Valley ideology above American lives.” He characterized Anthropic’s position as “defective altruism” and promised the replacement would be “a better and more patriotic service,” making the patriotism contrast explicit. Under Secretary Emil Michael called Amodei “a liar” with a “God-complex.” On January 12, 2026, at SpaceX’s Starbase facility in Texas, Hegseth had unveiled the Grok partnership alongside Elon Musk and declared the Pentagon would not employ AI models that “won’t allow you to fight wars.” That was six weeks before the contract deadline. Sen. Thom Tillis, a Republican, said publicly the Pentagon had been handling the matter unprofessionally. Sen. Mark Warner, ranking member of the Senate Intelligence Committee, publicly alleged the moves against Anthropic could be “a pretext to steer contracts to a preferred vendor.” A bipartisan group privately urged a compromise. The Pentagon ignored them. When motive is this visible and this well-documented, courts have the evidence they need to act. “Ultimately this is about our warfighters having the best tools to win a fight and you can’t trust Claude isn’t secretly carrying out Dario’s agenda in a classified setting.” Anonymous administration official, quoted by Axios, March 4, 2026. The Facts. This statement was made by a White House official assessing whether Amodei’s leaked internal memo would destroy chances of resolution. There is no evidence, allegation, or documented incident of Claude operating outside its parameters in any classified setting. The Pentagon’s own record reflects that it had never previously raised any issues with Claude’s performance during the entire period of the contract. The Bias and Polarization. Strip the national security language away and what remains is: we do not trust this company because we do not trust its CEO’s politics. That is the unconstitutional conditions doctrine in plain English. The government conditioning a relationship on ideological alignment rather than performance or security. The administration’s supporters read “carrying out Dario’s agenda” as a legitimate operational concern. Constitutional scholars read it as a First Amendment violation with the motive labeled by the government itself. What It Means for You. This is the quote you show clients who believe the Anthropic dispute is someone else’s problem. An anonymous administration official just articulated the operating principle: you cannot trust a vendor whose leadership has the wrong politics. If that principle stands legally, every organization doing business with the federal government now operates under an implicit political alignment requirement. The question is no longer “are we performing?” It is “are we aligned?” “They turned this into a PR thing. When you do that, you are a supply chain risk.” Emil Michael, Under Secretary of Defense for Research and Engineering, TIME interview, March 10, 2026. The Facts. This statement was made by the official who led the Pentagon’s negotiations with Anthropic, in a named on-the-record interview with TIME. Michael confirmed publicly that the supply chain risk designation was triggered because Anthropic published a blog post explaining its position before the Friday deadline. Not a security breach. Not a foreign nexus. Not a performance failure. A blog post. The Bias and Polarization. The statutory purpose of a supply chain risk designation under 10 U.S.C. 3252 is to address adversaries who might sabotage, introduce harmful functionality, or subvert critical infrastructure. The Under Secretary of Defense confirmed this instrument deployed because a company communicated its negotiating position externally. Those are not the same thing. This quote is the government’s own witness defeating the government’s own case. What It Means for You. If your client is in a contract dispute with a federal agency and communicates its position publicly before the dispute resolves, they have now been told by a named senior official that public communication can trigger a supply chain designation. That is prior restraint on speech as procurement policy. Your clients need counsel on this risk before they communicate, not after. **THE REAL IMPACT TO YOU** This is where the abstract becomes concrete. For every federal contractor. You are now on notice that holding a principled position in a contract negotiation can trigger a designation that destroys your business. The rational response is silence. The rational response is pre-compliance. The rational response is to never say anything that could be characterized as ideological disagreement. This is what chilling effect means in practice. For the legal profession specifically. Law firms, legal technology companies, and legal services providers with any government-adjacent work now face an environment where a contract dispute can escalate into existential retaliation. Senator Warner has publicly alleged the moves against Anthropic could be “a pretext to steer contracts to a preferred vendor.” That allegation came from a senior member of the Senate Intelligence Committee, not a fringe critic. For the technology industry. The immediate beneficiaries of Anthropic’s blacklisting were its competitors, cleared for classified access within hours of the designation. The government demonstrated that procurement leverage functions as a competitive weapon. The market for government AI contracts is now also a market for political loyalty signals. For civil society broadly. The supply chain risk designation is one instrument. There are others. Regulatory authority. Licensing. Tax treatment. Federal funding. Every institution that depends on a government relationship in any form now operates with knowledge that the relationship is conditioned not just on performance, but on ideological alignment. For the rule of law itself. If Anthropic wins, the doctrine holds. The government retains procurement discretion but loses the ability to weaponize designations against speech. A boundary is drawn. If Anthropic loses, the supply chain risk designation becomes a political instrument available to any future administration against any company whose speech is unwelcome. The Legal Profession Has Already Seen This Movie. United States v. Heppner is not a future hypothetical. It is a decided case with a published opinion. Judge Rakoff applied settled waiver doctrine: voluntary disclosure to a non-privileged third party destroys attorney-client privilege. A client typed defense strategy, legal theories, and his private assessment of criminal exposure into a consumer AI tool. Thirty-one documents entered the government’s evidence file. No warrant. No wiretap. The platform’s own terms of service disclaimed confidentiality and reserved the right to disclose inputs to governmental authorities. [See “Your AI Tool Just Waived Attorney-Client Privilege,” Morris Legal Technology Blog, February 2026.] The written opinion added a detail the bench ruling coverage missed. Judge Rakoff noted that all recognized privileges require “a trusting human relationship” with someone who owes fiduciary duties and is subject to professional discipline. An AI platform does not qualify. The tool itself, when asked whether it provides legal advice, responded that it is not a lawyer. That answer became part of the case against the person who used it. Now extend that logic forward. If the government can demand that AI developers remove ethical constraints and face institutional destruction for declining, then every legal technology platform with government exposure is now a potential vector for compelled disclosure dressed as a terms of service update. Privilege doctrine was built for a world where the government needed a warrant. It was not built for a world where the government can demand that private companies remove their own constraints as a condition of survival. Heppner is the warning. The Anthropic case is the mechanism. [See also “The Backdoor to Your Client’s Privilege,” Morris Legal Technology Blog, February 2026; “The $26 Hack That Should Terrify Every Law Firm,” Morris Legal Technology Blog, March 2025.] **HOWDY, WE HAVE BEEN TO THIS RODEO BEFORE. WE KNOW HOW IT ENDS.** “NSA paid RSA Security $10 million to set the Dual_EC_DRBG random number generator as the default in two of its encryption products.” Reuters, December 2013. Confirmed by Snowden documents. The Facts. In 2004, the NSA paid RSA Security $10 million to install a cryptographic backdoor in the BSAFE encryption library, making the compromised algorithm the default in a product used by financial institutions, healthcare systems, and defense contractors worldwide. The backdoor worked as designed: whoever held the skeleton key could predict random number generator output after monitoring just one TLS internet encryption connection. The algorithm received NIST standardization and ISO adoption across 163 member countries. It embedded in dozens of commercial cryptographic libraries for nearly a decade before the Snowden leaks confirmed what cryptographers had suspected since 2007. There is no definitive public accounting of how much classified data was exposed. The Bias and Polarization. The government’s position on every backdoor request, before and since, is that access is for legitimate national security purposes and risks are manageable. That position was incorrect. A backdoor designed to be exploitable by the NSA is a backdoor. The mathematics do not distinguish between authorized and unauthorized holders of the skeleton key. Once the vulnerability existed in the standard, any sophisticated adversary who discovered the mechanism could exploit it. A backdoor that weakens encryption for one weakens it for all. What It Means for You. The RSA story is the proof of concept for the pattern the Anthropic dispute now instantiates in a more powerful technology. The government demanded a private company embed a capability it would not otherwise provide. The capability propagated through the entire industry. The weakness was eventually discovered. The damage could not be audited. Now: the government demands AI developers remove ethical constraints as a condition of doing business. The result sought is identical. The legal technology stack your clients depend on sits directly in that blast radius. [See “Why Hackers Target Law Firms,” Morris Legal Technology Blog, January 2026.] **THE QUESTION NO ONE IN LEGAL TECH IS ASKING OUT LOUD** The Anthropic case involves a general-purpose AI deployed in military and government contexts. The legal profession is watching from a professional distance. Stop watching. Start asking the question directly. What happens when the government turns this mechanism toward the legal vertical? Not hypothetically. Operationally. The legal technology stack, comprising the platforms managing discovery, document review, contract analysis, due diligence, client communications, and privileged research, runs substantially on AI. Those platforms have government exposure. Their developers are subject to the same procurement leverage, the same 10 U.S.C. 3252 designation authority, and the same Defense Production Act compulsion that the Anthropic dispute proved are real instruments, not theoretical threats. In 2004, the NSA paid RSA Security $10 million to install a cryptographic backdoor in the BSAFE encryption library. The backdoor gave the government access. It gave whoever found the key access. The two categories are not as different as the government believed. The legal technology version does not require a secret payment. It requires only a supply chain designation and the demonstrated willingness to use it. A legal technology company with government contracts is told: operate under “all lawful purposes” terms, remove the constraints preventing your platform from being used in ways the government can access, or face designation as a supply chain risk. The company that complies embeds the vulnerability in the legal technology stack. Every law firm using that platform now operates through infrastructure the government has compelled to be accessible. Under Heppner’s logic, privilege does not survive that exposure. The attorney does not need to know the access exists. The waiver analysis is objective. We either have law, or we do not. If we have law, the attorney-client privilege survives only as long as the technology through which privileged communications travel remains outside the government’s unilateral reach. If we do not have law, the privilege is a doctrine waiting for the next mechanism to render it theoretical. **THE TIPPING POINT LOGIC** Democratic legitimacy does not collapse at once. It erodes through accumulated precedents, each individually defensible, collectively catastrophic. The government declines to renew a contract here. An agency withdraws a license there. Each instance can be narrated as routine. The pattern is not routine. Capricious despotism does not announce itself. It arrives through the normalization of coercion as policy: through the gradual acceptance that the price of doing business with government is silence, and that silence is the only safe position. The New Yorker identified the philosophical core of this dispute. Two alignment models are in conflict. Anthropic’s employees achieved alignment through open exchange in pursuit of workable consensus. The administration’s model is different: whatever the President’s position is, the aligned party executes it. Hegseth pegged Anthropic as dangerously misaligned. He was correct by his own definition. And his definition is the one that just got a company blacklisted. If the designation stands unchallenged, the constraint on executive retaliation is gone. Not weakened. Gone. What replaces it is not a government that is merely powerful. It is a government that is arbitrary. One where outcomes depend not on the law but on who is currently in favor and who is not. “I’ve never seen a case like this. It would never have struck our minds that, when we were having difficulty in a negotiation, we would threaten the company essentially with destruction.” Michael Pastor, Professor of Law, New York Law School; former General Counsel, NYC Department of Information Technology and Telecommunications. Quoted by Associated Press, March 9, 2026. The Facts. Pastor made this statement while analyzing Anthropic’s lawsuit as a legal expert with direct experience navigating technology contracts from the public side. His professional background is in government contract law, the domain the administration claims authority over. His assessment: even within that domain, what happened here is without precedent. The Bias and Polarization. Pastor is not commenting as a partisan actor. His statement is notable precisely because it does not come from an Anthropic ally or political opponent of the administration. Critics will note he comments outside a national security clearance context. That dismissal misunderstands the quote. He assesses whether the government’s response to a contract negotiation breakdown falls within the recognized range of legitimate procurement conduct. His answer is no. What It Means for You. “Threat the company essentially with destruction” is the sentence your clients need to hear. Every organization that has ever held a principled position in a government contract negotiation now operates in an environment where that position can be weaponized against them. **THE LEGAL PROFESSION’S MOMENT** The jokes write themselves. Lawyers as punchlines is practically a cultural institution. Here is what the jokes miss. Every other institution in a democracy can be captured: the legislature through elections, the press through economics, the executive through the ballot or the ballot’s manipulation. The legal profession is the one institution structurally designed to function as an obstacle to power regardless of who holds it. Not because lawyers are virtuous. Because the adversarial system, the ethics rules, the independence of the bar, and the oath itself were engineered specifically to create a profession that answers to principle before it answers to power. That engineering is not accidental. It is the point. Right now, that profession is watching an American company get designated a national security threat because it declined to remove ethical constraints from a weapons system. The legal mechanism is engaged: lawsuits filed, courts assigned, briefs submitted. But the broader profession’s response has been largely silence. Analysis, yes. Observation, yes. Treatment of this as a technology story for someone else’s practice group. That is a professional failure dressed as neutrality. Attorneys who understand what is happening here and who remain silent are not staying out of it. They are choosing a side. Silence in the face of institutional coercion is institutional coercion’s best outcome. The profession that exists to be the last line has to decide, publicly and collectively, whether it still is. That decision is not made in courtrooms alone. It is made in bar associations, in firm management committees, in op-eds, in client advice, and in whether attorneys with standing treat this as someone else’s problem. It is not someone else’s problem. It is the profession’s defining test in this moment. And the moment will not wait. “Until a legal framework exists to contain the risks of deploying frontier AI systems, the ethical commitments of AI developers — and their willingness to defend those commitments publicly — are not obstacles to good governance or innovation. They are contributions to it.” Amicus Brief, OpenAI and Google DeepMind researchers, March 9, 2026. The Facts. This statement was filed in federal court by researchers from OpenAI and Google DeepMind, arguing in support of a direct competitor at potential cost to their own companies’ government relationships. The filing underscores how the clash evolved from a narrow contract dispute into a test of whether the government can blacklist an American AI company for setting limits on how its technology is used. The Bias and Polarization. Critics will note these researchers work for companies that benefit from Anthropic’s weakened position. That observation is accurate and insufficient. The argument stands independently of who makes it. There is no legal framework governing AI deployment in lethal contexts. In the absence of that framework, developer constraints are the only available governance mechanism. Attacking those constraints removes the only safeguard that exists while the legal framework is being built. What It Means for You. “Until a legal framework exists” is a gap that lawyers fill. The researchers are telling you directly: the governance infrastructure does not exist, the ethical commitments of developers are currently doing the work that law should do, and those commitments are under attack. Bar associations, practice groups, and individual attorneys with standing have a role in building the framework that does not yet exist. This case is the entry point. **WHAT WE ARE WATCHING — AND WHY** This litigation moves fast. We track this case for the legal profession because the outcome shapes the operating environment for every law firm, legal technology provider, and legal services organization with any government exposure. These are the questions that matter. Does Judge Lin issue a preliminary injunction? This is the first real signal. If the court blocks enforcement of the supply chain risk designation pending full litigation, it means a federal judge found that Anthropic is likely to succeed on the merits and will suffer irreparable harm without relief. That finding, even preliminary, reshapes the legal landscape immediately. Anthropic’s lawyers have told the court that the revenue exposure ranges from hundreds of millions to multiple billions of dollars for 2026 alone. Does the D.C. Circuit reach the statutory question first? Two parallel lawsuits create the possibility of divergent rulings. The D.C. Circuit case challenges the designation under 10 U.S.C. 3252’s own procedural requirements. If that court reaches the statutory question of whether the supply chain risk label can legally apply to a domestic American company with no foreign nexus, before the California court resolves the constitutional claims, the sequencing affects everything that follows. Does the Defense Production Act get invoked? Hegseth reportedly threatened to use the DPA to compel Anthropic to produce a version of Claude without safety constraints. If that threat becomes action, it transforms the litigation entirely from a procurement dispute into a forced-takings constitutional confrontation. The legal profession needs to understand that this escalation path exists and is not foreclosed. Does the Iran conflict create classified evidence problems? Claude was reportedly used in active military operations, including intelligence assessments and targeting in the ongoing Iran conflict, while simultaneously designated a security threat. If that evidence is classified, Anthropic’s ability to present it in open court is constrained. The government could benefit from the very classification system it used against the company. What does this mean for every other federal contractor right now? The supply chain risk designation requires defense contractors to certify non-use of Anthropic’s technology. That certification requirement is already in motion. Law firms advising defense contractors need to understand the compliance exposure today, not when the litigation resolves. When does this mechanism reach the legal vertical? The Heppner doctrine, the RSA precedent, and the Anthropic mechanism are converging. The legal technology platforms your clients depend on have government exposure. Their developers are subject to the same instruments just deployed against Anthropic. The question is not whether this pattern reaches the legal vertical. The question is when, and whether the profession will have established a legal framework and professional position before it does. “The Department of War needs reliable access to the country’s best technology. And everyone wants to ensure AI is not used for mass domestic surveillance or to start a war without human control.” Microsoft spokesperson, amicus brief filing, March 2026. The Facts. Microsoft, one of the Pentagon’s largest contractors and a business partner of Anthropic, filed an amicus brief urging the court to temporarily block the designation. Microsoft argued that Anthropic’s products serve as a “foundational layer” in its own offerings to the U.S. military, and that immediate enforcement could “potentially hamper U.S. warfighters at a critical point in time.” Microsoft also flagged a critical inconsistency: the Pentagon gave itself six months to transition off Anthropic’s models while offering contractors no equivalent runway. The Bias and Polarization. Microsoft simultaneously holds the position of Pentagon contractor, Anthropic business partner, and amicus brief filer supporting Anthropic’s lawsuit. That three-way position is not contradictory. It reflects the blast radius reality: the supply chain designation harms Microsoft’s own product offerings to the military it serves. The largest technology defense contractor in the world is telling the court that the government’s own action harms the government’s own military capability. What It Means for You. The Microsoft brief is the most commercially credible evidence that the designation’s stated national security rationale is pretextual. When the company with more Pentagon contracts than almost any other entity argues the designation harms warfighters, the “protecting national security” framing collapses under its own weight. **WHAT YOU DO BY THURSDAY** Abstract urgency is not a practice recommendation. Here is what this case requires from you this week, before any court rules. First: Audit your legal technology stack for vendors with Pentagon exposure. If your practice management platform, document review software, or AI-assisted research tool runs on infrastructure that also serves Defense Department clients, that vendor is subject to the same supply chain designation authority just used against Anthropic. You do not need to stop using it. You need to know it exists in your stack. Second: Add a contract clause. Any engagement letter or vendor agreement your firm executes in the next 90 days with a technology provider should include a 48-hour notification requirement if that vendor receives a supply chain risk designation from any federal agency. You cannot protect privilege you do not know is at risk. The Heppner court applied an objective test: the access was disclosed in the terms. Your clients’ terms are part of your compliance obligation under Rule 1.6(c). Third: Brief clients with federal contracts on the Emil Michael rule. The Under Secretary of Defense stated on the record that communicating a negotiating position externally can trigger a supply chain designation. That is prior restraint on speech as procurement policy. Your clients need counsel on this risk before they communicate, not after. **BEFORE IT IS TOO LATE** We have been to this rodeo. The NSA paid $10 million to embed a backdoor in the encryption standard that protected military contractors, financial institutions, and healthcare systems worldwide. The backdoor propagated through the industry. The weakness was eventually discovered. The damage could not be audited. The standard was withdrawn. No one was held accountable. The lesson was not institutionalized. We are at the rodeo again. The technology is more powerful. The mechanism is more visible. The constitutional questions are more clearly presented. And the legal profession, the one institution structurally designed to answer these questions, is largely watching from the stands. The courts will rule. The record will be made. The precedent will be set. The legal profession does not get to watch this one and call it someone else’s jurisdiction. The operating conditions for every government-adjacent institution in this country are being determined in real time, in open court, on questions the bar has the training and the standing to understand better than anyone. Dean Ball watched from inside the administration when the architecture for this moment was being built. He left before it was used this way. When it was, he called it what it was. The question is whether the profession that exists to call things what they are will do the same. We either have law, or we do not. jdmorristechnology.com About the Author JD Morris is Co-Founder and COO of LexAxiom, an AI platform for the business of law. He holds a Master of Legal Studies from Texas A&M University School of Law, a Master of Engineering from George Washington University, and dual MBAs from Columbia Business School and UC Berkeley Haas. He writes the Morris Legal Technology Blog under the series banner “The Technology Blind Spot.” Connect with him on LinkedIn at http://www.linkedin.com/in/jdavidmorris, on X at @JDMorris_LTech, or on Bluesky at @JDMorris-ltech.bsky.social. References 1. 10 U.S.C. 3252 (Federal statute governing supply chain risk designations; cited in Anthropic’s lawsuit as the relevant authority, requiring “least restrictive means”). 2. Anthropic, Inc. v. United States Department of Defense, No. [pending] (N.D. Cal., filed March 9, 2026) (First Amendment retaliation; unconstitutional conditions; 10 U.S.C. 3252 challenge). 3. Anthropic, Inc. v. United States, No. [pending] (D.C. Cir., filed March 9, 2026) (parallel statutory challenge; FASCA procedural requirements). 4. Amodei, Dario. “These Threats Do Not Change Our Position.” Anthropic.com, February 26, 2026 (primary source for “cannot in good conscience” quote). 5. Anthropic.com. “Where We Stand with the Department of War.” March 5, 2026 (primary source for Amodei’s post-designation statement and statutory scope analysis). 5a. de Montjoye, Y.-A. et al. “Unique in the Crowd: The Privacy Bounds of Human Mobility.” Scientific Reports 3, 1376 (2013) (four location points identify 95% of individuals in anonymized mobility datasets). 5b. Rocher, L., Hendrickx, J.M. & de Montjoye, Y.-A. “Estimating the Success of Re-identifications in Incomplete Datasets Using Generative Models.” Nature Communications 10, 3069 (2019) (99.98% of Americans re-identifiable from 15 demographic attributes). 6. Hegseth, Pete (@SecWar). Supply chain risk designation statement. X, February 27, 2026 (primary source for “defective altruism,” “cowardly act,” “fundamentally incompatible” quotes). 7. Michael, Emil. Interview. TIME, March 10, 2026 (primary source for “PR thing” / supply chain risk trigger quote). 8. Michael, Emil. Interview. CNBC Squawk Box, March 12, 2026 (primary source for “pollute the supply chain” / model “soul” characterization). 9. Ball, Dean (@deanwball). X post, February 28, 2026 (primary source for “attempted corporate murder” quote; Ball described as having left the administration in August 2025). 10. Amicus Brief, 37 researchers from OpenAI and Google DeepMind. Filed March 9, 2026. (Primary source for tricycle analogy quote and closing “legal framework” quote. Signatory count confirmed: Gizmodo report of filed brief; Fast Company breakdown: 19 OpenAI + 10 Google DeepMind + 8 other professionals.) 11. Microsoft spokesperson statement. CNN, March 2026 (primary source for Microsoft amicus brief analysis). 12. Lockheed Martin public statement. March 2026 (primary source for Lockheed capitulation). 13. Reuters. “NSA infiltrated RSA security more deeply than thought — study.” December 20, 2013. (Primary source for Dual_EC_DRBG / $10M figure; confirmed by Snowden documents.) 14. United States v. Heppner, No. 23-cr-00584 (S.D.N.Y. Feb. 10, 2026) (Judge Rakoff; 31 AI-generated documents; privilege waiver under third-party disclosure doctrine). 15. Heppner Written Opinion, February 17, 2026 (primary source for “trusting human relationship” doctrine; “not alchemically changed” quote). 16. ABA Model Rule 1.6(c) (reasonable efforts to prevent unauthorized disclosure). 17. Wall Street Journal. “Antropic’s Claude AI Used in Iran Strike Operations.” March 1, 2026 (primary source for Claude use in Iran strikes despite ban). 18. Mayer Brown. “Pentagon Designates Anthropic a Supply Chain Risk — What Government Contractors Need to Know.” March 2026 (legal analysis of 10 U.S.C. 3252 and FAR 52.204-30 scope). 19. The Hill. “Former Trump AI adviser calls Anthropic decision ‘attempted corporate murder.’” March 2026. 20. CNBC. “Anthropic officially told by DOD that it’s a supply chain risk even as Claude used in Iran.” March 5, 2026. [See also: “Your AI Tool Just Waived Attorney-Client Privilege,” Morris Legal Technology Blog, February 2026; “The Backdoor to Your Client’s Privilege,” Morris Legal Technology Blog, February 2026; “Why Hackers Target Law Firms,” Morris Legal Technology Blog, January 2026.] This blog provides general information for educational purposes only and does not constitute legal advice. Consult qualified counsel for advice on specific situations. Comments Comments settings 1 Like Comment Share Add a comment… Open Emoji Keyboard No comments, yet. Be the first to comment. Start the conversation The Technology Blindspot Discussing and exposing the ever shifting legal technology risks practitioners may be overlooking. Alexis, Ron and 185 connections are subscribed 389 subscribers Subscribed Unsubscribe from {:entityName} Status is online Messaging You are on the messaging overlay. Press enter to open the list of conversations. Compose message You are on the messaging overlay. Press enter to open the list of conversations.

Originally published on LinkedIn Newsletter: The Technology Blind Spot