← STS Talks Jun 18, 2026 42 min read White Papers

You Don’t Have the Authority You Think You Have

The Pentagon demanded unrestricted authority to use a private company's AI, including for uses the company warned could enable mass domestic surveillance. The company said no. What the government did next is a lesson in how power behaves when it decides it has outgrown its limits.

The Pentagon demanded unrestricted authority to use a private company’s AI, including for uses the company warned could enable mass domestic surveillance. The company said no. What the government did next is a lesson in how power behaves when it decides it has outgrown its limits.

This piece covers the period from the collapse of Anthropic’s Pentagon contract talks and the early-2026 “supply chain risk” designation through the June 12, 2026 export directive that pulled two of its models offline worldwide. It reflects the public record as of June 18, 2026. As of this writing, no agreement restoring the models had been announced, in-person talks with the Commerce Department were reported to be ongoing, and Anthropic had not publicly announced an emergency judicial challenge to the export directive; its separate lawsuit over the earlier supply-chain designation remains active.

There is a sentence that has been spoken, in one form or another, in every American confrontation between private conscience and public power. A government official, frustrated that a company will not do what he wants, says: a private company does not get to tell the government how to set policy.

It sounds like common sense. It is, in fact, exactly backward. The government does not get to tell a private company to help it violate the Constitution. That is not policy. That is the line. And the entire architecture of American law exists to hold it.

We are watching that line get tested in real time. In the span of a few months, the United States government has declared one of the country’s leading artificial intelligence companies a “supply chain risk,” a label historically reserved for foreign adversaries; threatened to invoke wartime production authority to force that company to strip the safety controls off its own product; and then, days after the company launched its most capable model to the public, issued an export directive that gave no specific written explanation of the asserted national-security concern and forced the model offline worldwide. The throughline connecting all three moves is not national security. It is leverage. And the leverage was being sought over something Americans should refuse to walk past: the government demanded unrestricted authority to use a powerful AI system, including for two uses the company refused to authorize, fully autonomous weapons and the domestic mass surveillance of American citizens. The company said no.

Saying no was right. This piece is about why, and about why the right to say it does not belong to Anthropic alone. It belongs to every business, every developer, and every citizen who has ever been told that authority is a magic word. What we are watching is not security policy. It is the reflex of power that has decided the rules bind everyone but itself. The founders had a word for that reflex, and they did not whisper it.

First, the line that is not in dispute

Let me be precise, because the strength of this argument depends on its honesty. The government has real and legitimate authority to protect this country. It can investigate genuine threats. It can regulate dangerous technology. It can buy what it needs for defense. It can do all of this, and it should, when it proceeds through avenues the law actually provides: a statute that authorizes the action, a process that gives notice and a chance to respond, a rationale that can be written down and reviewed by a court.

Nothing in what follows is an argument against government. It is an argument against government by assertion. The objection is not that officials acted. It is that they acted as though the existence of a security concern were itself the authorization, as though invoking “national security” dissolved every procedural and constitutional constraint that would otherwise apply. It does not. It never has. The whole point of constitutional government is that power is hardest to use precisely when the stakes are highest, because that is when the temptation to abuse it is greatest.

The Pentagon does not get to “activate” authority it was never given

Start with the central legal error, because a sitting Secretary of Defense appears to believe something the Supreme Court spent one of its most famous cases warning against.

The reported posture from Defense Secretary Pete Hegseth is that the Pentagon should have access to commercial AI for “any lawful purpose,” that a contractor does not get to dictate the government’s use of technology, and that if a company resists, the Defense Production Act can be invoked to compel it. Set aside the politics. Look only at the law. The premise is that wartime and defense-priority authorities give the executive a kind of master key, a power to reach into the private sector and command production on the terms the executive prefers.

That is the constitutional instinct the Supreme Court rejected in Youngstown Sheet & Tube Co. v. Sawyer, 343 U.S. 579 (1952): the belief that an urgent national-security objective can itself supply executive authority the law has not granted. President Truman, citing the Korean War and the threat a steel strike posed to national defense, ordered the seizure of the nation’s steel mills. The justification was national security in its most literal wartime form. The Court said no. The President had no statute authorizing the seizure and no inherent constitutional power to take it, and the emergency did not manufacture the authority that the law withheld.

Justice Jackson’s concurrence in that case is the framework every law student learns and every executive official forgets. Presidential power is at its maximum when the President acts with the authorization of Congress. It sits in a “zone of twilight” when Congress is silent. And it is “at its lowest ebb” when the President acts against the expressed or implied will of Congress, for then he can rely only on his own constitutional powers minus whatever Congress has over the matter. Id. at 635-638 (Jackson, J., concurring).

Apply that here, and apply it honestly, because the Defense Production Act is not Truman’s bare seizure. It is an enacted statute, 50 U.S.C. § 4501 et seq., and the government will say that difference matters, that it acts with congressional authorization rather than against it, which is the strong side of Jackson’s framework rather than the weak one. Take that argument at its strongest, and it still does not reach what was threatened here. The DPA is a tool for prioritizing and allocating contracts, for getting things made and delivered in the order defense needs require. The questions it cannot answer in the government’s favor are these: whether its text authorizes compelling a company to redesign its product and tear out the safeguards it independently chose to build, whether the government made the findings and followed the procedures the Act itself requires, and whether any statute, however broad, can authorize compelling a private party to construct the instrument of a constitutional violation. A production-priority statute is not a master key to the design and the conscience of a private product. Youngstown is the warning here, not by itself the whole answer, and the warning is the durable part: it is the Court telling every official who came after Truman that the urgency of a thing is never the authority to do it. The authority has to come from somewhere the law actually placed it. “The Pentagon wants this badly” is not a somewhere.

The supply-chain-risk designation is the same move in another register, and on that one a federal court has already spoken. The narrow statute governing those designations, 10 U.S.C. § 3252, exists to keep genuine security threats out of the defense supply chain. When the government used it to brand Anthropic a supply chain risk after the company refused the Pentagon’s terms, Anthropic sued, and in March 2026 a federal judge in the Northern District of California granted a preliminary injunction. The court found Anthropic likely to succeed on its claims that the designation was First Amendment retaliation for the company’s public advocacy on AI safety, that it violated due process, and that it was likely both contrary to law and arbitrary and capricious. The judge wrote that nothing in the governing statute supports the Orwellian notion that an American company can be branded an adversary for disagreeing with the government, and that the record strongly suggested the stated reasons were pretextual and the real motive was unlawful retaliation. That is a preliminary finding rather than a final judgment, the government is contesting it, and a separate designation under a different statute is still being fought in another court. But it means the central charge here is no longer only mine to make. A federal court has looked at this government’s conduct toward this company and described it, in substance, as punishment for protected speech dressed up as security. When a security statute is bent to that purpose, it is not doing security work. It is doing punishment work, and the government does not get to repurpose a security statute into an instrument of retaliation against protected conscience.

Strip the euphemism off and look at the claim being made. An official who believes that invoking national security entitles him to commandeer a private company, strip the safeguards off its product, and direct it at the citizens those safeguards protect has not described the duties of a Secretary of Defense. He has described the appetite of a censor with a budget. The framers fought a war against precisely this proposition: that the holder of an office may treat his own certainty as law. They lost friends and fortunes to establish that he may not. A label is not a warrant. A title is not a verdict. And “because I have decided it is necessary” is the oldest justification tyranny has ever offered, which is exactly why the Constitution refuses to accept it.

Morality is not a defect in a contractor. It is the reason the Constitution holds.

Here is the part the official posture cannot account for. The company’s refusal was framed by the government as obstruction, as a contractor arrogantly setting policy. But look at what was actually refused. Anthropic declined to let its AI be used for fully autonomous weapons without human control over targeting and firing, and it declined to let its technology power the mass surveillance of American citizens.

A company that draws those lines is not undermining national security. It is refusing to become the instrument of conduct it regards as morally intolerable and legally dangerous, and the two refusals do not raise identical legal questions. Fully autonomous weapons implicate the laws of war, command responsibility, distinction, proportionality, and the moral demand that human beings remain accountable for lethal decisions. Mass domestic surveillance implicates something more specific and closer to home: the constitutional rights of the Americans subjected to it. And when a private actor is conscripted to do the government’s unconstitutional work, the conscription does not launder the violation. The Fourth Amendment does not evaporate because the surveillance runs on a vendor’s model instead of a government server.

We have been here before, and recently enough that no one gets to claim surprise. The mass collection of Americans’ communications records, exposed in 2013, was not a hypothetical. It was a working program. And when it reached the courts, it did not survive. In ACLU v. Clapper, 785 F.3d 787 (2d Cir. 2015), the Second Circuit held that the bulk telephone-metadata program was not even authorized by the statute the government claimed as its basis. In Klayman v. Obama, 957 F. Supp. 2d 1 (D.D.C. 2013), a federal district judge found the program likely violated the Fourth Amendment and called its technological reach “almost Orwellian,” a preliminary finding later set aside on standing and procedural grounds rather than repudiated on the merits. Congress then ended bulk collection through the USA FREEDOM Act of 2015. And in Carpenter v. United States, 138 S. Ct. 2206 (2018), the Supreme Court held that the government generally needs a warrant to obtain even the location data that a phone sheds automatically, because the sheer comprehensiveness of digital tracking implicates the Fourth Amendment in a way older doctrines never anticipated.

None of this means that every large-scale analysis the government performs is unconstitutional. That is not the law, and the argument does not need it to be. What these cases establish is narrower and entirely sufficient: dragnet surveillance of citizens is constitutionally fraught and statutorily constrained, and the more comprehensive the technology, the more searching the scrutiny it draws. So state the principle in the conditional, because the conditional is what makes it unbeatable. If the system the government wanted would collect or search constitutionally protected information about Americans without individualized suspicion or lawful process, then building it is precisely what the Constitution would forbid the government to do itself, and routing it through a private vendor would not cure the defect. The government cannot acquire through a contractor an authority it does not possess directly. A company that refuses to build that version of the system is not being difficult. It is declining to manufacture the very thing the Fourth Amendment exists to prevent, and there is nothing in the law that punishes a private party for that refusal.

When officials respond to that refusal by trying to force the capability into existence through production statutes and security designations, they are not protecting the country. They are trying to accomplish through a private contractor what they could not lawfully do directly. The Constitution does not permit the government to outsource its violations.

The logic does not stay inside one technology

There is a broader principle here that reaches well past artificial intelligence. Guns are technology. Encryption is technology. Drones, printing presses, communications networks, automobiles, chemical tools, and computer code are technology. Every powerful instrument can be used lawfully or destructively. If the bare possibility of misuse is enough to justify restricting the instrument itself, the principle has no limiting edge. It can be stretched to justify control over nearly anything.

The argument always opens the same way: bad people may do bad things with this tool, so responsible people must surrender access before any wrongdoing occurs. But that move changes the object of the law. The government stops punishing harmful conduct and starts rationing the capacity through which harm might someday be done. Suspicion shifts from the person who acts unlawfully to every person who merely has the ability to act.

The firearms debate exposes the danger from inside current constitutional law. Firearms can be misused to terrible effect. That fact is real, but it does not erase the right of ordinary people to possess and carry arms for lawful purposes. In New York State Rifle & Pistol Ass’n v. Bruen, 597 U.S. 1 (2022), the Supreme Court rejected the idea that the government may burden that right merely by asserting an important public interest; the government must prove that the restriction falls within the lawful bounds of its authority. And in United States v. Rahimi, 602 U.S. 680 (2024), the Court upheld disarming a person whom a court had found to pose a credible threat. That is the contrast: demonstrated dangerousness and individualized process, not blanket restriction justified by hypothetical misuse.

That distinction is the line this AI dispute threatens to erase. The government’s theory is not that a particular person used a model unlawfully and should be held to account. It is that possible misuse of a dual-use capability lets the executive decide who may possess the capability at all, disable lawful access before wrongdoing, and keep access for itself and the institutions it selects. The capability is not eliminated. It is concentrated.

The doctrines are not identical. The Second Amendment expressly protects arms; software may implicate the First Amendment, property rights, statutory protections, or other interests still being worked out. But the procedure travels even when the doctrines differ. Declare the tool dangerous. Invoke an emergency. Restrict access before adjudication. Keep exceptions for the state and favored partners. Then cite the earlier restriction as proof that the method is already accepted.

That is the portability that should alarm anyone, on any side. A government that may decide who is trustworthy enough to possess a technology, while claiming the technology for itself, is not eliminating danger. It is centralizing danger in the hands of those who already hold the greatest power to impose it.

The export directive: rule by assertion, in miniature

Which brings us to the most recent move, and the cleanest illustration of the whole pattern. Days after Anthropic released its most advanced public model, the government issued an export control directive ordering the company to cut off access for any foreign national, inside or outside the United States, including the company’s own employees. Because no company can verify the nationality of every user in real time, the only way to comply was to shut the model down for everyone, everywhere. The company did.

The government’s stated concern, as the company describes it, was a “jailbreak.” Strip the alarming word away and look at what the technique actually does: it asks the model to read a codebase and find and fix software flaws. That is not a weapon. It is what every competent security engineer does for a living, and what the defenders who protect American systems do every single day. The order itself, which the company says landed at 5:21 in the afternoon and forced a worldwide shutdown that same evening, contained, according to Anthropic, no explanation of the national-security concern specific enough to explain or test it. And the company says that when it reviewed the demonstration the government relied on, the technique surfaced only a handful of already-known, minor vulnerabilities, the kind that, by Anthropic’s account, other publicly available models, including a leading competitor’s, turn up without any bypass whatsoever.

Take the facts as Anthropic states them and apply the standard a court would. Under the Administrative Procedure Act, 5 U.S.C. § 706(2)(A), agency action is unlawful if it is arbitrary, capricious, or an abuse of discretion, and the governing test from Motor Vehicle Manufacturers Association v. State Farm, 463 U.S. 29 (1983), requires the agency to examine the evidence and articulate a satisfactory explanation, with a rational connection between the facts found and the choice made. An order issued with no stated basis, against a capability the company says is available across the industry, raises that arbitrariness problem squarely. The government may hold a contemporaneous rationale it has not yet shown, and a court would demand the administrative record before ruling. A rationale concealed from the affected party and absent from any reviewable record does not become lawful merely because officials assure the public that one exists. Secrecy may protect evidence; it cannot erase the government’s obligation to possess its reasons, preserve them, and defend them before a court. A power that never has to show its reasons to anyone is not law operating at its limit. It is fiat wearing law’s clothes.

And here the record, even on the government’s own timeline, turns from arbitrary toward incoherent. By Anthropic’s account, in the weeks before launch the government was among those in the room: the company says it worked with United States government personnel, the United Kingdom’s AI Safety Institute, and outside experts for thousands of hours to stress-test this model’s safeguards, which it says tested as substantially stronger than those of any model previously released. Take that account at face value and the sequence is hard to defend. Government personnel took part in testing the safeguards. The model shipped. And days later the same government ordered the product pulled from the entire planet, on the strength of a jailbreak that, again by Anthropic’s account, it has described only verbally, with nothing committed to paper. Participating in a red-team is not the same as blessing a product, and the government may yet articulate a rationale it has so far kept to itself. But an agency that helps test a safeguard and then revokes the product without putting a reason on the record is not visibly making a national-security judgment. It is making one the public cannot review, and a judgment that escapes review is not yet entitled to be called security. On the record as it stands, it reads closer to whim with a letterhead.

There is a deeper constitutional problem still, and it has a history. The thing being restricted is, at bottom, software, and American courts have already wrestled with the government using export controls to suppress code. In the Bernstein litigation of the 1990s, the government tried to use export rules to stop a mathematician from publishing encryption source code, treating the code as a controlled munition. A federal district court held that source code is expression protected by the First Amendment and that the licensing regime operated as an unconstitutional prior restraint. Bernstein v. United States Department of Justice, 945 F. Supp. 1279 (N.D. Cal. 1996). That holding is a powerful analogy rather than a settled rule, and honesty requires saying why: the appellate opinion affirming it was later withdrawn for rehearing, and the government mooted the fight by rewriting its regulations rather than let a higher court settle the question against it. But the retreat is itself the tell. When the government has reached for export law to silence code before, it has chosen to back down rather than defend the theory to judgment.

Whether that precedent governs a hosted AI model is a genuinely open and different question, and an honest argument admits it: publishing source code to the world is not identical to operating a commercial model behind an interface. But the open question cuts toward caution, not away from it. The legal classification is less settled here, but the practical reach of the restraint is vastly larger: not a licensing requirement on a single publication, but a total, worldwide shutoff of a service already deployed to customers around the world. The government that retreated from the smaller fight thirty years ago is now asserting the larger power through a written directive whose specific technical basis, according to Anthropic, was never placed in the letter and was supported only by evidence communicated verbally. It is asking the public to assume that authority exists before it has been required to defend that authority in open court.

And one more doctrine sits in the government’s path. When an agency claims a sweeping new power over a question of vast economic and political significance, the Supreme Court now demands clear authorization from Congress. West Virginia v. EPA, 597 U.S. 697 (2022). Congress has given the executive real authority over the export of emerging and foundational technologies, so this is contested ground rather than a closed case. But reading that authority to permit disabling a globally deployed commercial AI service, through a written directive that provided no specific explanation of the asserted national-security concern, is exactly the kind of expansive claim the major-questions doctrine exists to make the government prove rather than presume. These are serious arguments that demand adjudication. The point is not that the courts have already ruled. It is that the government has acted as though they never need to.

What the company got wrong, fairly stated

None of this makes the company a hero, and an honest argument says so plainly. There is nothing wrong with negotiating. There is nothing wrong with a company trying to preserve a working relationship with the government while disagreeing with it. Negotiation is not capitulation, and refusing to negotiate is not principle. But what happened here was not negotiation. It was capitulation, and the distance between those two words is the whole point.

Faced with the export directive, the company complied first and contested second, and it is worth being blunt about how much stronger its hand was than its response. The company was not without leverage. It had, on its own account, helped the government test this very model. Its safeguards were the strongest it had ever deployed. The capability at issue was, by its telling, available across the industry. The order arrived with no rationale on the record. None of that made defiance free. An export-control directive can carry serious civil and even criminal exposure, for a company and sometimes for the people who run it, and simply ignoring it was never the responsible move. But there is a wide country between ignoring an order and surrendering to it, and the company chose the surrendering end of that country, switching the model off for the entire world within hours.

Compare that to how Apple answered in 2016, when the government obtained a court order directing it to build a tool to break into a phone. Apple immediately opposed the order and moved to vacate it, forcing the government to defend its claimed authority in court, and the government blinked before any court ruled. The mechanisms are not identical, and an honest comparison says so: Apple was resisting a judicial order under the All Writs Act, with a judge already in the loop, while Anthropic faced an administrative export directive, a different instrument carrying different risks. But the posture is the lesson. There was a path that was neither defiance nor surrender, and Anthropic did not take it. It could have complied under express protest while racing into court that same week for emergency relief, forcing the government to identify its authority and defend the directive in front of a judge. Instead it shut the models down and contested the decision mainly through a courteous blog post that called the order a “misunderstanding.” Disagreement expressed while obeying, and never once tested in court, is not resistance. It is obedience with a press release, and the government has never once been deterred by a press release.

This is where the company’s choice stops being its own affair and becomes everyone’s. When the party with one of the strongest available cases to resist chooses instead to comply without forcing the question, it does not just lose its own round. It helps normalize the method. It signals to every agency watching that a written directive carrying no specific, reviewable explanation of the asserted national-security concern can pull a lawful product off the global market before any judge reviews it, without a meaningful opportunity to contest its specific basis, and with no adequate reasons placed on a reviewable record, and that the target may not even force the government into court. Compliance like that does not create a binding legal rule, but it creates something nearly as durable: a practical precedent, a settled expectation of what companies will tolerate. That is how a boundary erodes. Not in the dramatic moment when the government seizes more than it is owed, but in the quiet one when the party best positioned to say “prove it” decides that compliance is cheaper than principle.

A company can shrink its own legal risk and enlarge everyone else’s in the very same motion, and that is close to what happened here. The posture that protects not just the company but the country is the one the Constitution already models: obey a valid order if you must, but do not preemptively surrender to one you believe is invalid. Comply under protest, then go to court the same day and make the government stand up and justify itself. Anthropic had the standing, the facts, and the lawyers to force exactly that confrontation, and it chose the softer road. As of June 18, 2026, it had not publicly announced an emergency judicial challenge to the directive; its response had run through public statements and continuing negotiation with the government. Naming that plainly is not unfair to the company. It is the least the moment demands, because a right that its own holders will not assert is not a right for long. It is a courtesy the government extends until the morning it decides to stop.

Rule by access

There is another danger buried in this record, and it does not depend on proving anyone’s private motive. Before the directive landed, Amazon’s chief executive reportedly carried concerns about Anthropic’s product directly to senior administration officials, including the Treasury Secretary, and coercive government action followed within days. Amazon is not a disinterested observer. It is a major Anthropic investor, Anthropic’s primary cloud and training partner, a distributor of its models, and a competitor with its own large stake in the AI market. Amazon had every right to communicate a genuine security concern; petitioning the government is protected, and a sophisticated company is entitled to raise an alarm. But the legitimacy of what followed cannot rest on the purity of a powerful actor’s intentions.

The injury is structural, and intent is beside the point. One private actor possessed direct access to officials capable of disabling another company’s product worldwide, while the company on the receiving end got no comparable chance to test the allegation before the consequence fell. That is not equal government merely because every citizen holds a theoretical right to petition. A right to send a letter is not the same institutional power as the ability to reach a Cabinet secretary, prompt an immediate response, and set the coercive machinery of the state in motion. When wealth, corporate position, and personal proximity decide whose warnings receive instant governmental force, a country begins to split into two classes: those who must petition the state, and those who can summon it.

The problem is not whether Amazon acted from malice, concern, commercial interest, public spirit, or some mixture of all four. A constitutional system cannot be made to depend on discovering the private heart of whoever entered the room. It must contain procedures capable of telling a genuine warning apart from mistaken analysis, institutional self-interest, competitive pressure, or private leverage. That requires written reasons, disclosed standards, a meaningful chance for the affected party to answer, and independent review before the government makes the injury irreversible. Strip those away and privileged access becomes a form of private authority: the connected actor supplies the allegation, the government supplies the force, and the absence of transparent process ensures the public may never learn whether the state protected national security or simply converted one influential participant’s position into national policy. That is not rule of law. It is rule by access, and wealth, status, investment, or proximity cannot be permitted to function as a private warrant for public coercion.

The precedent is not collateral. It is the injury.

Step back from the two missing models, because the real damage is not that they vanished. It is the method their disappearance leaves behind.

Government power rarely announces that it intends to become permanent. It presents each new authority as a narrow answer to an extraordinary problem. But the authority claimed for the exception does not dissolve when the immediate dispute ends. It enters the institutional memory of the executive branch. One administration asserts it. The target complies. No court reaches the merits. And the next administration points to the earlier exercise as proof that the power has already been accepted. That is how a constitutional limit is displaced without ever being repealed: practice substituted for law, repetition substituted for authorization, and the government’s success at avoiding review folded into its argument that review was never required. What begins as a disputed exception hardens into a playbook.

We have watched that playbook run before, in a setting as far from a software dispute as can be imagined, which is precisely why it is worth invoking. The cases share no facts. They share an architecture, and the distance between them is what exposes it.

On September 30, 2011, the United States deliberately killed Anwar al-Awlaki, an American citizen, in a drone strike in Yemen, without charging him, trying him, or presenting the evidence for his death to any court. Before the strike, his father sought judicial review. A federal court dismissed the suit on threshold grounds, standing and the political-question doctrine, and pointedly declined to decide whether the killing would be lawful. Al-Aulaqi v. Obama, 727 F. Supp. 2d 1 (D.D.C. 2010). The judge himself named the disturbing asymmetry at the center of it: that judicial approval was required to wiretap a citizen abroad but supposedly forbidden to review his killing. The judiciary never reached the merits before the executive made the deprivation irreversible.

Months after the man was already dead, the Attorney General supplied the theory. In a 2012 address at Northwestern University School of Law, Eric Holder argued that due process and judicial process are, in his phrase, not one and the same, and that the Constitution guarantees the first but not necessarily the second. Read in the context of a planned executive killing of a citizen, that was no modest procedural footnote. It was a claim that the branch seeking the power could supply the constitutional process for itself. The same executive identified the target, gathered and withheld the evidence, defined imminence, judged capture infeasible, interpreted the scope of its own war powers, decided what process was due, and carried out the killing, and then declared that its private deliberations had satisfied the Constitution. The accuser was the factfinder. The factfinder was the tribunal. The tribunal was the executioner. And every official in that chain answered to one President. That is not independent due process. It is executive self-certification.

It is true, at the highest and most useless level of abstraction, that due process does not always require a judge. No court order is needed before a soldier returns fire, before an officer acts to save a life, before officials meet a genuine emergency that leaves no time to adjudicate. But the emergency exception cannot be allowed to swallow the rule. When the executive has time to investigate a citizen, build a secret record, write legal memoranda, debate the conditions for lethal force, and plan the operation, it cannot claim that independent review was impossible. It can only claim that review would have constrained it. Even in the wartime-detention context, the controlling opinion in Hamdi concluded that a citizen whom the government labels an enemy must receive notice of the factual basis for that classification and a fair opportunity to contest it before a neutral decisionmaker. Hamdi v. Rumsfeld, 542 U.S. 507, 533 (2004) (plurality opinion). A government that owes a citizen an independent decisionmaker before continuing his imprisonment cannot simply assume that it owes him less before making his death permanent.

And a judge is not magic either. Courts can abdicate as easily as they can protect: accepting secret assertions without examination, letting the government define the evidence and the standard at once, invoking standing and secrecy and the political-question doctrine until the irreversible act is done and no one has reached the merits. A robe does not convert abdication into due process. The judiciary’s duty is not merely to be present. It is to be independent, to demand evidence, test authority, and decide the constitutional question before the government makes relief impossible.

What the al-Awlaki episode produced, beyond the deaths, was a transferable architecture: the executive may define a threat in secret, interpret the limits of its own power, set the procedures it deems sufficient, act before any court reviews the evidence, and then defend the finished act as lawful national security. That architecture did not stay attached to the administration that built it, or to the officials who promised to use it carefully. It attached to the office. Powers never remain tethered to the judgment or restraint of the people who first claim them. They pass intact to every successor, including the ones the original architects would never have trusted with them. The only honest constitutional question is never whether today’s official seems responsible. It is what the asserted authority will permit in the hands of the least responsible person who ever occupies that chair.

The same ratchet is turning here. The government asserts national security. It withholds a reviewable explanation. It imposes the consequence before any independent adjudication. The company complies. The models disappear. The government secures the practical result it wanted without ever proving that Congress authorized it, that the facts justified it, or that the Constitution allowed it. Anthropic’s public disagreement does not interrupt that sequence. Its compliance completes it.

The company did not create binding legal precedent. It helped create something nearly as durable: practical precedent, proof that an unexplained assertion can win worldwide compliance before a judge ever looks at it. The next official now holds more than a theory. He holds an example that the theory works. The next company receives more than an order. It receives the message that the last company obeyed. And the next court meets not a novel claim but a power the government will describe as one it has exercised before. That is how the boundary moves: not because the Constitution changed, and not because Congress transferred the power, but because the government asserted, private power yielded, and review came late or never.

Responsibility, then, does not stop with the official who signs the order. The government is responsible for claiming authority beyond its limits. Anthropic is responsible for making that claim effective without forcing the government to defend it. And any court that later treats completed compliance as a reason to avoid the merits will be responsible for allowing executive practice to harden into constitutional custom. The Constitution does not permit the government to be the author, interpreter, witness, and judge of its own necessity. A company with the resources to demand review cannot credibly call acquiescence resistance merely because it published its objection afterward. And courts are not absolved when standing, secrecy, jurisdiction, or delay accomplishes the constitutional surrender that an express ruling on the merits could not.

That is why the precedent is not collateral damage from this dispute. The precedent is the injury: the machinery left assembled for the next administration, the next asserted emergency, the next company, and the next citizen told that the government has done this before and therefore must be allowed to do it again.

The founders were not shy. Neither should we be.

There is a fashion now for treating plain speech as a kind of incivility, as though the gravest abuses deserve the gentlest adjectives. The men who built this country did not share that fashion. The Declaration of Independence is not a measured memo. It is an indictment. It catalogs a king’s abuses one after another, names them as the deliberate acts of a tyrant, and declares that a government which becomes destructive of the rights it exists to secure has forfeited its claim to obedience. Thomas Jefferson, contemplating resistance to overreaching power, wrote that the tree of liberty must be refreshed from time to time, that every generation owes the next a willingness to confront encroachment rather than wait politely for permission to remain free. That is the American inheritance. Vigilance, stated without apology, is not extremism. It is the founding posture, and it was written by men who pledged their lives against a government that had decided its authority was beyond question.

So let us not be coy about what is on display. An official who treats “national security” as a phrase that suspends the Bill of Rights has named the ambition of a censor, not the duty of a public servant. An executive that disables a lawful product worldwide through a written command whose specific factual basis it has not placed on the record has assumed the prerogative of a sovereign, not the role of an officer of law. An agency that reaches for the private lives of citizens at scale, and tries to conscript the companies that build the tools to do it, is rehearsing the exact abuse the Fourth Amendment was written to forbid. These are not strong words chosen for effect. They are the accurate ones. When conduct matches the description the founders gave of tyranny, a free people is under no obligation to invent a softer name for it.

The softness is the trap. Power counts on being met with euphemism, because euphemism is how encroachment is made to feel reasonable, one modest-sounding step at a time, until the sum of the steps is a country that no longer recognizes its own constraints. The answer is not rage and it is not noise. It is clarity with an edge: the law cited exactly, the abuse named exactly, and not one inch of pretense that the two are unrelated. The framers understood that a right unenforced is a right surrendered, and that the surrender almost never arrives as a single dramatic seizure. It arrives as a series of reasonable requests that no one was willing to refuse out loud.

The principle, stated plainly

Strip away the specifics and the rule is simple enough to put on a single page.

The government does not get to do a thing simply because it is the government. It does not get to command the private sector because an official believes he holds the authority. It does not get to convert security statutes into instruments of retaliation, or production statutes into instruments of commandeering, or export rules into instruments of censorship. It does not get to surveil citizens at scale by conscripting the companies that build the tools. And it does not get to escape review by refusing to write down its reasons.

These are not anti-government positions. They are the government’s own rules, the ones it agreed to when it took the power in the first place. Youngstown is the government’s rule. State Farm is the government’s rule. The Fourth Amendment is the government’s rule. The people who wrote them understood something the current posture has forgotten: that the danger to a free country has never come only from its enemies. It comes, reliably, from officials who are certain they are right and impatient with the process that exists to check them.

We are at a point where that impatience has hardened into a habit across more than one agency, and the habit needs to be named and refused, out loud and without apology. Not with mere noise, but not with deference either. With the law, and with the plain contempt that lawlessness in high office has always earned in this country. The strongest answer to power that exceeds its limits is not the loudest voice in the room. It is the clearest one, pointing at the limit and saying: that is the line, you drew it yourself, you swore an oath to it, and you do not get to cross it now because you have decided this time is special.

Every time is special. Every encroachment arrives wearing the face of necessity. That is exactly why the line must hold, and exactly why a free people must say no while saying no still costs only words. Repetition cannot create a power the Constitution withheld. Compliance cannot convert assertion into law. And no President, no agency, no company, and no judge should leave this episode believing that silence will be mistaken for consent.

Sources and Authorities

A reference appendix so readers can review the legal authorities, litigation records, company statements, and reporting behind this article. The Anthropic litigation and the export-control dispute remain ongoing; preliminary rulings are not final judgments on the merits. Current-status items reflect the public record as of June 18, 2026. This is commentary and journalism, not legal advice. Because the Anthropic disputes remain active, readers should consult the linked dockets for developments occurring after June 18, 2026.

I. The Anthropic–government litigation (primary record)

These are two separate proceedings, under two different statutes, and should not be conflated.

Anthropic PBC v. U.S. Department of War, No. 3:26-cv-01996-RFL (N.D. Cal., filed Mar. 9, 2026) (Lin, J.): Order Granting Motion for Preliminary Injunction, Dkt. No. 134 (Mar. 26, 2026). The 43-page order found Anthropic likely to succeed on its First Amendment retaliation, Fifth Amendment due-process, and Administrative Procedure Act (contrary-to-law and arbitrary-and-capricious) claims as to the 10 U.S.C. § 3252 supply-chain designation, the Presidential Directive, and the Hegseth Directive. The full order and docket are public (CourtListener docket No. 72379655; Civil Rights Litigation Clearinghouse case No. 47876; the order PDF is also mirrored by several nonprofits).
Anthropic PBC v. U.S. Department of War, No. 26-1049 (D.C. Cir.): the separate challenge to the designation issued under 41 U.S.C. § 4713 (FASCSA). The D.C. Circuit denied Anthropic’s emergency motion to stay on April 8, 2026, while allowing the case to proceed. (Distinct from the N.D. Cal. matter above.)

II. Company statement and the export directive

Anthropic, “Statement on the US Government Directive to Suspend Access to Fable 5 and Mythos 5” (June 12, 2026), https://www.anthropic.com/news/fable-mythos-access. The company’s primary account of the 5:21 p.m. letter, the absence of specific detail in the letter, the verbally conveyed jailbreak evidence, the worldwide shutdown, the comparison to other models, and the pre-launch red-teaming.

III. Constitutional and administrative-law authorities

Youngstown Sheet & Tube Co. v. Sawyer, 343 U.S. 579 (1952) (esp. 635–38, Jackson, J., concurring): executive power depends on the relationship between executive action and congressional authorization; an emergency does not itself create authority.
Motor Vehicle Mfrs. Ass’n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983): an agency must examine the evidence and articulate a satisfactory explanation with a rational connection between the facts found and the decision made.
West Virginia v. EPA, 597 U.S. 697 (2022): agencies claiming authority over questions of vast economic and political significance must point to clear congressional authorization.
ACLU v. Clapper, 785 F.3d 787 (2d Cir. 2015): the NSA bulk telephone-metadata program exceeded the statute the government relied on.
Klayman v. Obama, 957 F. Supp. 2d 1 (D.D.C. 2013) (bulk collection likely unconstitutional; reach “almost Orwellian”), vacated and remanded on standing grounds, Obama v. Klayman, 800 F.3d 559 (D.C. Cir. 2015) (the appellate court did not adopt the district court’s Fourth Amendment analysis as a binding merits holding).
Carpenter v. United States, 585 U.S. 296, 138 S. Ct. 2206 (2018): government acquisition of historical cell-site location data generally requires a warrant.
Hamdi v. Rumsfeld, 542 U.S. 507, 533 (2004) (plurality opinion): a citizen detained as an enemy combatant must receive notice of the factual basis for the classification and a fair opportunity to rebut it before a neutral decisionmaker.
Al-Aulaqi v. Obama, 727 F. Supp. 2d 1 (D.D.C. 2010): the pre-strike challenge was dismissed on threshold grounds (standing and the political-question doctrine) without adjudicating the constitutionality of the proposed killing; see also the later damages action, Al-Aulaqi v. Panetta, 35 F. Supp. 3d 56 (D.D.C. 2014), also dismissed without a merits ruling that the program was lawful.
New York State Rifle & Pistol Ass’n v. Bruen, 597 U.S. 1 (2022) (esp. 17, 24): the Second Amendment protects an individual right; the government may not justify a firearm restriction merely by asserting an important interest, but must show the restriction is consistent with the nation’s historical tradition of firearm regulation. Cited here for the contrast between blanket prophylactic restriction and a right the government must affirmatively justify.
United States v. Rahimi, 602 U.S. 680 (2024): upheld the temporary disarmament of a person whom a court had found to pose a credible threat to another’s physical safety; cited here to contrast a restriction tied to an individualized judicial finding with a broad restriction justified only by the possibility that some users may misuse a protected instrument.

IV. Encryption, software, and the First Amendment (the Bernstein record)

Bernstein v. U.S. Dep’t of State, 922 F. Supp. 1426 (N.D. Cal. 1996): source code can contain expression protected by the First Amendment.
Bernstein v. U.S. Dep’t of Justice, 945 F. Supp. 1279 (N.D. Cal. 1996): the export-licensing regime operated as an unconstitutional prior restraint.
Bernstein v. U.S. Dep’t of State, 974 F. Supp. 1288 (N.D. Cal. 1997): broader declaratory and injunctive relief against the revised regime.
Bernstein v. U.S. Dep’t of Justice, 176 F.3d 1132 (9th Cir. 1999), opinion withdrawn and rehearing en banc granted, 192 F.3d 1308 (9th Cir. 1999): the withdrawn panel opinion has no binding precedential effect and should be cited only with that qualification; the dispute was later mooted by regulatory change.
Electronic Frontier Foundation, “Bernstein v. U.S. Department of Justice,” case archive and litigation history.

V. Apple and the All Writs Act (litigation documents, not a merits ruling)

In re Search of an Apple iPhone Seized During the Execution of a Search Warrant, No. ED 15-0451M (C.D. Cal.): Order Compelling Apple, Inc. to Assist Agents in Search (Feb. 16, 2016).
Apple Inc., Motion to Vacate Order Compelling Apple Inc. to Assist Agents in Search (filed Feb. 25, 2016). The government later withdrew its request after reporting it had accessed the device by other means; no court issued a final merits ruling on Apple’s statutory or constitutional objections. (The Electronic Privacy Information Center and EFF maintain document collections for this matter.)

VI. Targeted killing and due process (primary government statement)

Att’y Gen. Eric Holder, Address at Northwestern University School of Law (Mar. 5, 2012), U.S. Department of Justice archives: the statement that “due process” and “judicial process” are “not one and the same,” and that prior judicial approval is not constitutionally required before the executive uses lethal force abroad against a qualifying American citizen.

VII. Statutes and constitutional provisions

U.S. Const. amends. I, IV, V.
Defense Production Act of 1950, 50 U.S.C. § 4501 et seq. (priority performance of contracts and allocation of materials, services, and facilities; see § 4511).
10 U.S.C. § 3252 (armed-services procurement; supply-chain-risk designation).
41 U.S.C. § 4713 (Federal Acquisition Supply Chain Security Act).
Administrative Procedure Act, 5 U.S.C. § 706(2)(A).
Export Control Reform Act of 2018, 50 U.S.C. § 4801 et seq. (emerging and foundational technologies; see § 4817).
USA FREEDOM Act of 2015, Pub. L. No. 114-23, 129 Stat. 268.

VIII. Reporting and contemporaneous coverage

Each entry below is an individual source verified against the public record as of June 18, 2026. Reuters may block automated fetches, but the Reuters entry below was confirmed through search results, syndicated copies, and the article’s Reuters slug before inclusion.

The June 12 directive and the worldwide shutdown:

CNBC, “Anthropic disables access to Fable 5 and Mythos 5 to comply with government directive” (June 12, 2026), https://www.cnbc.com/2026/06/12/anthropic-disables-access-to-fable-5-and-mythos-5-to-comply-with-government-directive.html. Reports the timing and worldwide scope of the shutdown.
Quartz, “Anthropic disables Claude Fable 5 and Mythos 5 after U.S. export order” (June 12, 2026), https://qz.com/anthropic-fable-5-mythos-5-export-control-directive-061226. Reports the Lutnick letter and the absence of a stated rationale in the letter itself.
Decrypt, “US Government Orders Anthropic to Pull Claude Fable, Mythos AI Models” (June 13, 2026), https://decrypt.co/371027/us-government-orders-anthropic-pull-claude-fable-mythos-ai-models. Reports the verbally conveyed evidence, the comparison to other models, and White House adviser David Sacks’s account of the government’s side.
Fortune (Jeremy Kahn), “Anthropic disables Fable and Mythos AI models after U.S. government bars it from giving foreigners access” (June 13, 2026), https://fortune.com/2026/06/13/anthropic-disables-fable-mythos-export-controls-national-security-threat/. Reports the worldwide suspension, the absence of specific detail in the letter, that the directive would bar even Anthropic’s own foreign employees, and Anthropic’s “misunderstanding” characterization.
Heise Online, “US government forces shutdown of Anthropic’s AI Fable 5 and Mythos 5” (June 2026), https://www.heise.de/en/news/US-government-forces-shutdown-of-Anthropic-s-AI-Fable-5-and-Mythos-5-11331146.html. Notes that the find-and-fix capability is routine in security review and that no universal jailbreak was identified.

The government’s and critics’ account, included for balance:

Reuters (Stephen Nellis and Greg Bensinger), “Amazon voiced concerns about Anthropic AI models before US government’s crackdown, source says” (June 13, 2026), https://www.reuters.com/business/retail-consumer/amazon-voiced-concerns-anthropic-ai-models-before-us-governments-crackdown-2026-06-13/. Reports that Amazon CEO Andy Jassy was among tech leaders who raised concerns about Anthropic’s models with senior administration officials before the directive; Amazon told Reuters that governments sometimes seek its counsel on security risks and that it does not share the details of such discussions.
TechCrunch, “Amazon CEO reportedly raised Anthropic model concerns before government crackdown” (June 13, 2026), https://techcrunch.com/2026/06/13/amazon-ceo-reportedly-raised-anthropic-model-concerns-before-government-crackdown/. Reports the Wall Street Journal account that Jassy told Treasury Secretary Bessent that Amazon researchers used Fable 5 to obtain information usable in cyberattacks, and Amazon’s response that it does not disclose details of such discussions.
explainx.ai, “Why Did the US Gov Ban Fable 5? The Full Anthropic Story” (updated June 17, 2026), https://www.explainx.ai/blog/us-government-bans-fable-5-mythos-5-anthropic-export-control-2026. Compiles the timeline and the mid-June status: talks continuing, no restoration agreement announced, technical rebuttal not yet published.
TechCrunch (Lorenzo Franceschi-Bicchierai), “Cybersecurity vets protest ‘dangerous’ US government ban on Anthropic’s most powerful models” (June 15, 2026), https://techcrunch.com/2026/06/15/cybersecurity-vets-protest-dangerous-us-government-ban-on-anthropics-most-powerful-models/. Reports an open letter signed by dozens of cybersecurity experts (including Alex Stamos, Casey Ellis, Jon Callas, Paul Vixie, Dino Dai Zovi, Katie Moussouris, and Rachel Tobac) urging the government to withdraw the directive, and Moussouris’s analysis that the cited “jailbreak” amounted to asking the model to fix code containing known and deliberately planted vulnerabilities, a capability replicable on other public models.

The supply-chain designation and the preliminary injunction:

NPR, “Judge temporarily blocks Trump administration’s Anthropic ban” (March 26, 2026), https://www.npr.org/2026/03/26/nx-s1-5762971/judge-temporarily-blocks-anthropic-ban. Reports Judge Lin’s First Amendment retaliation finding and the “Orwellian” characterization.
CNBC, “Anthropic wins preliminary injunction in DOD fight as judge cites ‘First Amendment retaliation'” (March 26, 2026), https://www.cnbc.com/2026/03/26/anthropic-pentagon-dod-claude-court-ruling.html. Reports the ruling and the underlying dispute over autonomous weapons and domestic surveillance.
FedScoop, “District court temporarily blocks Anthropic ban, supply-chain risk designation” (March 26–27, 2026), https://fedscoop.com/district-court-temporarily-blocks-anthropic-ban-supply-chain-risk-designation/. Reports the retaliation finding and the court’s treatment of the designation.
Breaking Defense, “Judge grants Anthropic preliminary injunction but Pentagon CTO says ban still stands” (March 27, 2026), https://breakingdefense.com/2026/03/judge-grants-anthropic-preliminary-injunction-but-pentagon-cto-says-ban-still-stands/. Reports the pretext finding and the separate § 4713 designation.
CNBC, “Anthropic loses appeals court bid to temporarily block DOD ruling” (April 8, 2026), https://www.cnbc.com/2026/04/08/anthropic-pentagon-court-ruling-supply-chain-risk.html. Reports the D.C. Circuit’s denial of a stay as to the § 4713 designation.

Primary court record and legal analysis:

Order Granting Motion for Preliminary Injunction, Anthropic PBC v. U.S. Department of War, No. 3:26-cv-01996-RFL, Dkt. 134 (N.D. Cal. Mar. 26, 2026), full PDF hosted by the Center for Democracy & Technology, https://cdt.org/wp-content/uploads/2026/04/2026-03-26-134-ND-Cal-Order-Granting-PI.pdf.
Docket: CourtListener, https://www.courtlistener.com/docket/72379655/anthropic-pbc-v-us-department-of-war/. Case page: Civil Rights Litigation Clearinghouse, https://clearinghouse.net/case/47876/.
Anthropic, “Statement on the US Government Directive to Suspend Access to Fable 5 and Mythos 5” (June 12, 2026), https://www.anthropic.com/news/fable-mythos-access (also cited in Section II as the company’s primary account).

The Amazon–Anthropic institutional relationship (primary sources):

Anthropic, “Powering the next generation of AI development with AWS” (Nov. 22, 2024), https://www.anthropic.com/news/anthropic-amazon-trainium. Anthropic’s own statement that the additional $4 billion investment “establishes AWS as our primary cloud and training partner,” brings Amazon’s total investment to $8 billion as a minority investor, and that Claude is distributed through Amazon Bedrock.
Amazon Web Services, “Claude by Anthropic in Amazon Bedrock,” https://aws.amazon.com/bedrock/anthropic/. Documents Amazon’s commercial distribution of Anthropic’s Claude models.

Shawn Paul Cosner
Sparked Technology Solutions, Inc.