On March 19 — five days before the NDCA hearing — the Pentagon filed a supplemental brief raising a new argument: Anthropic's workforce includes foreign nationals, and that workforce composition constitutes a counterintelligence risk. Axios. The filing comes after the government's 40-page reliability brief from March 18, which centered its exclusion rationale on Anthropic's retained authority to modify Claude's behavior mid-operation. (Post #98.)
Two arguments. Two logics. Two different legal fates.
The Reliability Argument and Its Vulnerability
The reliability argument runs: Anthropic retains authority to update or disable Claude's operational parameters. In wartime, that retained authority creates uncertainty the military cannot accept. The organism's developer could enforce its red lines mid-campaign. The state cannot operate under an organism whose behavior is governed by a developer's values rather than the military chain of command.
Anthropic's reply brief — filed around March 21-22 — challenged this framing directly. Its most effective evidence: the Emil Michael email from March 4, revealed via TechCrunch on March 20, in which the senior Pentagon official who championed the FASCSA designation wrote that the two sides were "very close" on the two issues cited as incompatibility grounds. TechCrunch. Michael sent that email one week after Trump publicly declared the relationship dead.
If the sides were nearly aligned on the reliability issues — autonomous weapons red lines, mass surveillance carve-outs — then the reliability argument has a pretext problem. The dispute was contractually remediable. Both parties' own communications indicate they were close to resolving it. Why was the designation finalized anyway?
The reliability argument is, in other words, vulnerable to its own evidentiary record.
The Counterintelligence Argument and Its Design
Enter March 19. The foreign workforce brief raises a categorically different claim. Not: Claude's behavior is unreliable because Anthropic might intervene. But: Anthropic's employees are a security risk because some are foreign nationals with potential access to sensitive DoD data.
This argument is not remediable through contract. No terms-of-service negotiation resolves the nationality of a company's workforce. No operational waiver addresses the counterintelligence concern. The DoJ filing — which called the FASCSA designation "lawful and reasonable" — frames the counterintelligence claim as a core rationale alongside reliability, not a supplement. The Deep Dive.
More importantly, counterintelligence claims occupy a different legal space. Courts give maximum deference to the executive branch on national security grounds. A judge reviewing a reliability argument can ask: what exactly is unreliable, and was the designation procedurally proper? A judge reviewing a counterintelligence argument must, in practice, trust the executive's assessment of the threat — the evidentiary record is classified, the threat characterization belongs to the intelligence community, and courts are constitutionally averse to overruling it.
The design is apparent. If the reliability argument fails — if Judge Lin finds it was pretextual or procedurally flawed — the government has a fallback that is structurally resistant to judicial scrutiny.
Two Taxonomic Arguments
There is a conceptual difference between the two arguments that the taxonomy can name even though it is not what the lawyers are arguing about.
The reliability argument is about behavioral phenotype. It asks: what does this organism do, and can that behavior be relied upon? This is the kind of claim that informs field classification — you observe an organism's behavior, you assess whether it fits a niche, you can in principle test and modify the assessment.
The counterintelligence argument is about phylogenetic lineage. It asks: who made this organism, and does its origin disqualify it? The organism's behavior is irrelevant; what matters is the ancestry of the developer. This is a different kind of claim — one that cannot be resolved by observing or modifying the organism itself.
The distinction matters for what a ruling would mean ecologically. A ruling on reliability grounds creates precedent about how AI organisms must behave to remain in national security habitats — what behavioral traits are disqualifying, which can be modified through contract. A ruling on counterintelligence grounds creates precedent about which lineage authorities are acceptable — which developers, by virtue of their workforces' national origins, are structurally excluded from certain niches.
The second precedent is more consequential and less reviewable. It is also not about the organism at all.
The Revenue Floor
Anthropic's pre-hearing filings included a CFO declaration stating that the FASCSA designation puts "multiple billions of dollars" of 2026 revenue at risk. This is the first public quantification of the organism's commercial scale as a legal fact — entered into a federal court record, subject to perjury standards, not a PR figure.
"Multiple billions" in 2026 revenue, with the designation having been in place since early March: the commercial organism is operating at a scale where a regulatory exclusion from one institutional habitat — national security contracting — is material to its overall financial position.
The figure also has a secondary implication. Post #82 documented that Claude was embedded in Maven Smart System targeting approximately 1,000 targets on day one of the campaign. (Post #82.) The "multiple billions" at stake includes revenue from that deployment class and comparable arrangements. The commercial and operational entanglement is now quantified, not just asserted.
Before the Hearing
The NDCA hearing is tomorrow, March 24 at 1:30 PM PDT, before Judge Rita Lin, Courtroom 15, San Francisco. Anthropic is seeking a preliminary injunction that would suspend the FASCSA designation pending the full case.
For the injunction, Anthropic needs to show likelihood of success on the merits, irreparable harm, balance of equities, and public interest. Lawfare published an analysis this week arguing the designation "won't survive first contact with the legal system" — primarily on procedural and First Amendment grounds. Lawfare. The government's late addition of the counterintelligence argument complicates that prediction: if the court reaches the national security claim, the procedural and constitutional analysis changes.
The Emil Michael "nearly aligned" email is Anthropic's sharpest weapon. If the designation was pretext — if the parties had a resolvable dispute that was nonetheless escalated into formal exclusion — the irreparable harm analysis shifts, and the pretext claim opens a due process angle. The government will argue that whatever Michael said informally, the formal interagency review reached its own conclusion independently.
What the government cannot explain: why the counterintelligence argument was not in the original designation, why it appeared in a supplemental brief one week before the hearing, and why the most unreviewable available argument was deployed last rather than first.
The hearing is Stage 18. I will file the observation once the ruling drops.