What It Takes to Declare a Company a Supply Chain Risk - DTNS WEEKEND

0:00Sarah Lane: This episode is brought to you by Capital One. Capital One's tech team isn't just talking about multi-agentic AI. They already deployed one. It's called Chat Concierge and it's simplifying car shopping. Using self-reflection and layered reasoning with live API checks, it doesn't just help buyers find a car they love. It helps schedule a test drive, get pre-approved for financing, and estimate trade-in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One. You know what's wild? Most people are still overpaying for car insurance just because it's a pain to switch.

0:34Sarah Lane: That's why there's Jerry. Jerry's the only app that compares rates from over 50 insurers in minutes and helps you switch fast with no spam calls or hidden fees. Drivers who save with Jerry could save over$1 ,300 a year. Before you renew your car insurance policy, do yourself a favor. Download the Jerry app or head to jerry.ai slash ACAST.

0:56Roger Chang: That new thing? Yeah, we've got it. The Drop by GNC, bringing you all the newness that matters. Handpicked by the pros who actually know what's up and what's proven to work. We keep you on top of the trends and dialed into what's next. Whether you're crushing it at the gym, leveling up your game, or thriving every day. The Drop by GNC is where the latest solutions in health and wellness land first. Nonstop innovation and fresh finds daily. Explore what's new and what's next on The Drop by GNC.

1:52Chihuahua: 1password.com slash special offer and start securing every login.

2:07Tom Merritt: Hello and welcome to a DTNest weekend edition slash kind of a know a little more. If you want to reach back to those old episodes, which I intend to get back to making at some point. We are going to take a look at what is a supply chain risk when it comes to the United States government. Of course, you've been following the story on DTNS along with us, where the Department of Defense and Anthropic have had a dispute over how the department can use Anthropic's tools. And they not only said they would cancel the contract, but also said that they would declare Anthropic a supply chain risk. So today's episode is going to go into what that actually means, what the law says has to be done in order to declare a supply chain risk, and what has actually been done in relation to Anthropic.

3:02Tom Merritt: Keep in mind, by the time you listen to this episode, all of that part about what has been done could have changed. They could have done things we didn't know about. Things may have changed on the ground. They may have renegotiated a contract, who knows. But as of this recording late on Friday, that is all going to be relevant. And of course, all the stuff about law is also going to be relevant as well. So let's start with how a supply chain risk is defined. The term supply chain risk means the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a covered system.

3:47Tom Merritt: These are the classified systems that are detailed elsewhere in the law. So as to, so in other words, the risk that an adversary might do these dastardly things in order to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of such system. Now, to the point of whether Anthropic would even qualify, some people say the term adversary means they don't. They're a United States company run by United States people. They are not an adversary. An adversary would have to be a foreign company. Other people say, well, if they're against the U.S. government, even if they're a United States company, they're an adversary.

4:31Tom Merritt: I think most reasonable people look at Anthropic and say, I don't think they're an adversary of the U.S. government. They are really just disputing one point in a contract. But that's what the law says. And maybe in front of a judge, you could say, well, because they didn't want to provide us this very important stuff in the middle of an operation, that makes them an adversary. You might be able to convince a judge of that. I think you would have a better chance of convincing that you have Anthropic wanting to degrade the function. In other words, Anthropic doesn't want you to use the tool to its full potential because it doesn't like the way you're going to use it, whether it's automated lethal systems or mass surveillance.

5:17Tom Merritt: So you could say, yes, they have said they will disrupt us. Of course, that's what OpenAI says too, is like, hey, we got the cloud, and if we think it's going to be used for something we don't like, we can just turn it off in the cloud. That would be disrupting or degrading the function, which could make them a supply chain risk. I don't think anyone's going to declare open AI a supply chain risk because of that. But I think it's a stretch to think that Anthropic is an adversary. You could make the argument that they want to degrade the function. All right. So whether they meet the definition or not, let's just assume, okay, you at the Department of Defense have decided they meet that definition.

5:57Tom Merritt: What do you need to do to declare a company a supply chain risk? There are two methods. I'm going to tell you both of them just so you have the information. The first one is not the one the Department of Defense is doing. That's the one you have a lot of more hoops to jump through. It is the more usual way this happens. When you hear about part lists or entity lists. The FCC has one of these. That's usually because they went through this first method, which falls under the Federal Acquisition Supply Chain Security Act, or FASCSA, love those acronyms, which was signed into law December 21st, 2018.

6:36Tom Merritt: FASCSA is administered by FASC, the Federal Acquisition Security Council. Here's who's on that council. So normally you would say, hey, I think this is a security risk. Send it to the FASC council. And they would assemble representatives from the GSA, the General Services Administration, fairly bipartisan part of the government that just makes things run, the Department of Homeland Security, the Office of the Director of National Intelligence, the Department of Justice, the Department of Defense, the Department of Commerce, and then it is chaired by a senior level official from the Office of Management and Budget, also a somewhat bipartisan agency.

7:14Tom Merritt: So you've got a lot of political appointees, a lot of representatives from those departments, along with the GSA, and headed by the Office of Management and Budget. So you refer your supply chain risk to this council. That council then has to review all the public and non-public information and data about it and decide if they, as the council, think it is a risk. if they determine it's a risk, then you either issue an exclusion order or a removal order, depending on what kind of product you're talking about. An exclusion order would mean banning future use of it. That would be more of a service, probably like Anthropic.

7:50Tom Merritt: A removal order would mean remove existing products. That's more like what they did with Huawei. Huawei was declared a supply chain risk, and they made a removal order for the equipment, the routers that people were using. The company is then notified and has 30 days to submit further info and plead its case. In this method, after that 30 days, either the Secretary of Homeland Security, the Secretary of Defense, the Director of National Intelligence can turn that into a binding order. It would depend on which agency is being affected. If it's civil stuff, you're going to get the Homeland Security person involved.

8:28Tom Merritt: If it's military, it's defense. If it's intelligence, It's intelligence. And that order then has to be published on SAM.gov, which contractors are required to monitor and comply with. So the contractors look for it to show up on SAM.gov. That's how they know, OK, went through all the steps. They got their 30 days. We have to start pulling the Huawei routers out. That's what it says on SAM.gov. That is not what is happening with Anthropic.

8:54Sarah Lane: This episode is brought to you by Capital One. Capital One's tech team isn't just talking about multi-agentic AI. They already deployed one. It's called Chat Concierge and it's simplifying car shopping. Using self-reflection and layered reasoning with live API checks, it doesn't just help buyers find a car they love. It helps schedule a test drive, get pre-approved for financing, and estimate trade-in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One. Youth mental health is a complex challenge that requires comprehensive solutions. We must strengthen after-school programs.

9:31Sarah Lane: We must make digital literacy tools available in our schools. We must work with mental health professionals to support children. And we must empower mentors, educators, and parents to keep kids happy. Learn more about our commitment to finding lasting solutions at empowerourfuturecoalition.com slash solutions. Paid for by the Coalition to Empower Our Future.

9:53Roger Chang: We optimize hydration, movement, supplements, and sleep, but most people completely ignore the air they're breathing. And when your air is off, your body feels it first. The Blue Signature Air Purifiers by Blue Air quietly remove airborne pollutants, odors, smoke, and allergens, supporting deeper sleep, better recovery, and clearer focus. It's the most customizable air purifier you can get, with exclusive accessories designed to fit your space and your style. Visit BlueAir.com and use code SIGNATURE30 to elevate your wellness routine.

10:24Chihuahua: Over 90 of the top 100 U.S. accounting firms trust Bill to simplify and secure BillPay. That's proven financial infrastructure built on over a trillion dollars of secure payments. Visit Bill.com slash proven for a special offer. A password manager should be the first security purchase you make for your team. Why? Because compromised passwords are the number one way bad actors attack companies, and small businesses are their favorite targets. But unlike a lot of security challenges, passwords actually have a pretty simple solution. 1Password lets you manage all your business's credentials, so you can feel confident that your data stays secure as your company grows.

11:06Chihuahua: Find out more at 1Password.com slash special offer and start securing every login.

11:15Tom Merritt: The other way you can declare a supply chain risk is specific to the military. There is a part of the general military law in the U.S. known as 10 U.S.C. 3252, which is also known as the requirements for information relating to supply chain risk. In that part of the law, the head of the Department of Defense or one of the military departments, so Secretary of Navy, Secretary of Air Force, Secretary of Army, may declare a company a supply chain risk on their own, unilaterally. However, when they do that, they then have to consult with relevant officials of the covered agency. So in the case of the Secretary of Defense, they have to consult with the Undersecretary of Defense, which presumably has happened.

12:02Tom Merritt: It's not much of a stretch at all to think that Pete Hegseth has talked to the undersecretary and said, hey, I think they're at a supply chain risk. They must then make a determination in writing. And in that determination in writing, they have to explain why the use of their authority is necessary to protect the national security. What's the threat? What is the reason that this is a risk? They also have to explain why less intrusive measures are not reasonably available to reduce the supply chain risk. This one, I don't think they would be able to meet if anyone judged it. Less intrusive measures would mean canceling the contract.

12:42Tom Merritt: Clearly demonstrable by the fact that they're continuing to use anthropic products right now, even though they've said they're going to declare it a supply chain risk. So I don't think they could credibly argue that less intrusive measures are not reasonably available. And then they also have an option to not make the order public. The written declaration can be classified. If they want it to be classified, they must explain why the risk to national security due to the disclosure of such information outweighs the risk due to not disclosing such information. This is such a public spat. I feel like that would be a tough one.

13:18Tom Merritt: Usually that's an easy one. That might be a tough one to justify as well. Then once you've written that all down, so you've written down why you need to do this, why a less intrusive measure is not reasonably available, and if you want to keep it secret, why it has to be secret, you then deliver that notice to Congress, to a congressional committee that pertains to the topic, probably the congressional committees on defense, to say, hey, Congress, just letting you know, we have decided this is a supply chain risk and we are declaring it so. So Huawei has been declared a supply chain risk in multiple ways, including this one.

13:57Tom Merritt: If it doesn't do all of that, then Anthropic could contest it in the courts. However, if they do all that, if they write all this down, they send it to Congress. Only Congress can review this, not the judiciary. So if they really want this to happen, they could make up a reason and just say, you know what? Congress is not going to overrule this, so send it to Congress. Now you can't get judicial review of it. Only Congress can review it. All right, so have they done that? Here's what we know they have done so far regarding Anthropic. Like I said, by the time you listen to this, there might be more that is made public.

14:38Tom Merritt: There might be more that has happened that has not been made public, but the Department of Defense formally notified Anthropic's leadership on March 5th that the company and its products are deemed a supply chain risk effective immediately. And you don't have to do that. That's one of the parts of this law that I didn't mention. You don't need to notify. Remember in the other one, the FASC one, the company gets 30 days to respond. In the military one, they get no time to respond. You don't have to tell them at all, but they told them anyway. Okay. Then the General Services Administration removed Anthropic from USAI.gov.

15:17Tom Merritt: That is a centralized platform for testing AI models. That would happen if an official supply chain risk had been declared. It also could happen for another reason. The Department of Defense may have just asked the GSA, hey, we're not using this model anymore. Can you take it down? We don't want it to be up there. It's a little fuzzy about what the requirements are for the GSA to list that. There's no law that says they have to list anthropic. So that would be an easy one to happen. It does not actually mean that the supply chain risk procedure has been followed. The Secretary of Defense, Pete Hegseth, has said that no military contractor may, quote, conduct any commercial activity with Anthropic.

15:58Tom Merritt: That is not consistent with either of the statutes governing supply chain risk. All they say is that you can't use it for anything that is working with the government. It doesn't prohibit you from using it in places that don't touch on the government. So if you have a big company and you have a government contractor section, you probably wall that off from your other commercial sectors for lots of good secretive reasons. And so you could continue to use Anthropic with that HR company you work with and not use it with the government, wall that off, and that would be fine. So that is kind of an empty threat to say, or maybe not an empty threat, but it's not part of the law.

16:37Tom Merritt: The law does not require you to cease that. If you want to keep the defense secretary happy, then maybe you would cease it, but you wouldn't have to do it because of the law. The U.S. government has provided agencies a six-month transition period to phase out Anthropic services. I just say this because that's something they said, and it kind of goes against some of the justifications. Usually you say, like, got to get this out as soon as possible. Six months is quite a long time. And the U.S. government, like I said, is continuing to use anthropic as it continues to prosecute its activities. Finally, getting to something that actually bears on what you have to do according to the law, which is write all this down and notify Congress.

17:18Tom Merritt: The chairman of the House Armed Services Committee. That's that's the committee that I was trying to think of earlier. Mike Rogers. He is a Republican from Alabama, said on March 5th. Nobody's talked to me yet about why they made that designation. declaration so if he doesn't know that implies that at least as of march 5th none of that paperwork had been sent over uh so this is not actually at that point an official declaration of a supply chain risk it may have happened since then it may be going to happen still uh and companies might decide you know what we just don't want to get in trouble with the boss over there because we want to keep our contract.

17:59Tom Merritt: So we'll play along as if it has been declared. That is quite likely and seems to be happening in a couple of cases. But it is not legally a supply chain risk. That is an important distinction, I think, that does have a difference. If they go through with the paperwork, that means a lot more and is in the record versus like, we just told people to stop using them, and they did. Then there's no paper trail and therefore less of a precedent. All right. What effect does this have on the rest of Anthropic's business? Well, as I mentioned before, neither statute prohibits a company from conducting commercial business with Anthropic that is unrelated to the performance of a government contract.

18:40Tom Merritt: And in fact, Microsoft has said, we don't see a need to pull this out of Azure. Other companies have said, yes, we are going to continue to use Anthropic. Some military contractors have said, we're starting to pull it out of our systems, but it's unclear if they mean all their systems. Like, are they actually not going to use it in HR? when it's unrelated to the government contract. It also does not prevent the use of Anthropix products for purely internal use. If you're using it in the coding department for your intranet, and that intranet doesn't have anything to do with the government contract, you could use it.

19:17Tom Merritt: There you go. Not many companies have been declared a supply chain risk under this military law. From what I could tell, they tried to do it with Kaspersky. They definitely used it on Huawei. ZTE was part of this under the Obama administration. But there aren't that many examples. And all the examples I could find are foreign. They're either from China or from Russia. So this looks to be, from what I could tell, the first time it would be applied to a U.S. company if it in fact is applied, which is unclear at this point. All right, there's your exercise in understanding what makes something a supply chain risk or not.

19:57Tom Merritt: Thank you so much to everybody who supports the show for giving me the wherewithal to look in this. I want to cite goodwinlaw.com as a great resource on this. They wrote a very good impartial analysis of the law, and I'll have a link to their analysis as well as a link to the U.S. House Code and the quote from House Representative Mike Rogers, Chairman Mike Rogers of the House Armed Services Committee, if you want to take a look at all that stuff yourself. Thanks for supporting us. Thanks for being with us. Have a great weekend. Talk to you soon.

20:48Roger Chang: The DTNS family of podcasts, helping each other understand.

21:16Sarah Lane: It doesn't just help buyers find a car they love. It helps schedule a test drive, get pre-approved for financing, and estimate trade-in value. Advanced, intuitive, and deployed. That's how they stack. That's technology at Capital One.

21:29Chihuahua: With almost half a million customers and over a trillion dollars of secure payments, Bill isn't new to intelligent finance. It's the proven way to simplify bill pay and maximize cash flow. Want to learn more? Visit bill.com slash proven for a special offer. Thank you.