Declaration of Emil Michael: Anthropic poses security risks

Declaration of Emil Michael – #96, Att. #3 in Anthropic PBC v. U.S. Department of War (N.D. Cal., 3:26-cv-01996) – CourtListener.com Back to Docket Your Notes ( edit ) (none) Share Support FLP CourtListener is a project of Free Law Project , a federally-recognized 501(c)(3) non-profit. Members help support our work and get special access to features. Please become a member today. Join Free.law Now Anthropic PBC v. U.S. Department of War × Please Sign In or Register Sign In Register × If you use PACER, please install RECAP Launched in 2010, the RECAP extension is a free tool for your browser that helps us collect the content you see on CourtListener. Once installed, anything you buy on PACER gets automatically added to the RECAP Archive and anything another RECAP user has bought is automatically free to you. Continue to PACER Learn More… × Congratulations on your first request! By clicking 🙏, you used 1 of your 5 daily prayers asking somebody to buy a document for you from PACER. Your prayer will now show up on our leaderboard of most-wanted PACER documents , and when the community buys it for you, we'll send you an email to let you know. Learn more Got it! Declaration of Emil Michael — Document #96 , Attachment #3 Attachments Entry 96 — Opposition/Response to Motion Att. 1 — Declaration of James W. Harlow Att. 2 — Exhibit A: Dep't of War Documents (Redacted) Att. 3 — Declaration of Emil Michael Att. 4 — Proposed Order District Court, N.D. California Docket Number: 3:26-cv-01996 Citation: Anthropic PBC v. U.S. Department of War, 3:26-cv-01996, (N.D. Cal. Mar 17, 2026) ECF No. 96 Date Filed: March 17th, 2026, 4:48 p.m. PDT Uploaded: March 17th, 2026, 5:18 p.m. PDT Add Note Search this PDF Toggle Dropdown Search full Docket Download PDF Toggle Dropdown From CourtListener Buy on PACER Description OPPOSITION/RESPONSE (re 6 MOTION for Temporary Restraining Order MOTION for Preliminary Injunction MOTION to Stay Pursuant to Section 705 ) filed byPaul S. Atkins, Scott Bessent, Frank J. Bisigano, Mary Anne Carter, Douglas A. Collins, Executive Office of the President, Federal Housing Finance Agency, Federal Reserve Board of Governors, Edward C. Forst, General Services Administration, Peter B. Hegseth, Jared Isaacman, Robert F. Kennedy, Jr, Scott Kupor, Howard Lutnick, National Aeronautics and Space Administration, National Endowment for the Arts, Ho K. Nieh, Kristi Noem, Jerome H. Powell, William J. Pulte, Marco Rubio, Securities and Exchange Commission, U.S. Department of Commerce, U.S. Department of Energy, U.S. Department of Health and Human Services, U.S. Department of Homeland Security, U.S. Department of State, U.S. Department of Veterans Affairs, U.S. Department of War, U.S. Department of the Treasury, U.S. Nuclear Regulatory Commission, U.S. Office of Personnel Management, U.S. Social Security Administration, Chris Wright. (Attachments: # 1 Declaration of James W. Harlow, # 2 Exhibit A: Dep't of War Documents (Redacted), # 3 Declaration of Emil Michael, # 4 Proposed Order)(Harlow, James) (Filed on 3/17/2026) (Entered: 03/17/2026) PDF Text Oops! Your browser does not support embedded PDF viewing. Download PDF Toggle Dropdown From CourtListener Buy on PACER Case 3:26-cv-01996-RFL Document 96-3 Filed 03/17/26 Page 1 of 8 UNITED STA TES DISTRICT COURT 2 NORTHERN DISTRICT OF CALIFORNIA 3 SAN FRANCISCO DIVISION 4 ANTHROPIC PBC, Case No. 3 :26-cv-0 1996-RFL 5 6 Plaintiff, 7 DECLARATION OF EMIL MICHAEL V. 8 U.S. DEPARTMENT OF WAR, et al., 9 10 Defendants. 11 12 Pursuant to 28 U.S.C. § 1746, I, Emil Michael, declare as follows: 13 1. I am the Under Secretary of War for Research and Engineering (USW(R&E)) and Chief 14 Technology Officer for the Department of War (Do W). I have held this position since May 20, 2025. 15 2. In my current position, I am responsible for spearheading the Department's efforts to 16 ensure U.S. military technological superiority and keep DoW at the forefront of innovation. I provide 17 strategic direction and oversight for DoW's entire research, development, and prototyping 18 enterprise, which includes providing critical input on the acquisition, implementation, and use of cutting- 19 edge technologies such as artificial intelligence (AI). 20 3. This declaration is based on my personal knowledge as well as information made available 21 to me through reasonable diligence in the course of my official duties. 22 DoW's Title 10, Section 3252 Authorities 23 4. Organized under Title 10 of the United States Code, DoW is the largest government 24 agency of the United States. DoW oversees the United States' armed services and coordinates the 25 national defense. In service of the national defense, DoW awards contracts to and sets terms and 26 policies with various entities that supply the Department with the technologies needed to advance U.S. 27 military and national defense capabilities. 28 Case No. 3:26-cv-1996-RFL Declaration of Emil Michael Case 3:26-cv-01996-RFL Document 96-3 Filed 03/17/26 Page 2 of 8 5. As part of its acquisition and procurement authorities under 10 U.S.C. § 3252, DoW 2 conducts supply chain risk assessments of covered procurements involving covered systems and 3 covered items of supply, as defined in that section. 10 U.S.C. § 3252(d)(3), (4). lf DoW determines 4 that there is a significant supply chain risk to a covered system, the Secretary of War is authorized to 5 take covered procurement actions, as defined by Section 3252, to exclude the source of the risk from 6 covered systems to protect national security. 7 6. Under Section 3252's implementing regulations, this exclusion authority may be 8 exercised by the Secretary of War only after "[o]btaining a joint recommendation by the Under 9 Secretary of War for Acquisition and Sustainment and the Chief Information Officer of the Department 10 of War, on the basis of a risk assessment by the Under Secretary of War for Intelligence, that there is a 11 significant supply chain risk to a covered system." 48 C.F.R. § 239.7304. The Office of the Under 12 Secretary of War for Intelligence and Security 1 (USW(I&S)) ordinarily would have had responsibility 13 for conducting such supply chain risk assessments because of its general expertise in handling security 14 matters and its prior relationships with the information offices of the Department, including the Office 15 of the Chieflnformation Officer, which reported to USW(I&S) until 2012. But after a recent 16 reorganization within Do W, the subject matter expertise for conducting certain risk assessments is no 17 longer located solely within USW(I&S). 18 DoW's 2025 Reorganization 19 7. Prior to 2025, the Chief Digital and Artificial Intelligence Office (CDAO), founded in 20 2022, was a standalone function that reported directly to the Deputy Secretary of War. CDAO's 21 mission is to accelerate Do W's adoption of AI to ensure that our warfighters have the best capabilities 22 to dominate on the battlefield and have full trust that the technologies they are using to create decision 23 advantage are secure and trustworthy. 24 8. In 2025, DoW underwent a reorganization. As part of the reorganization, CDAO was 25 realigned and began to report to the Under Secretary of War for Research and Engineering. Because of 26 its institutional and subject matter expertise, CDAO inherited responsibility for Section 3252 supply 27 1 In the FY 2020 NOAA, the Under Secretary for Intelligence was renamed as the Under Secretary for 28 Intelligence and Security to better capture the scope of the authorities vested in the office. Case No. 3:26-cv-1996-RFL 2 Declaration of Emil Michael Case 3:26-cv-01996-RFL Document 96-3 Filed 03/17/26 Page 3 of 8 chain risk assessments relating to AI issues. As a result, my office has assumed responsibility for 2 providing CDAO's supply chain risk assessments relating to AI issues to the Under Secretary of War 3 for Acquisition and Sustainment and the Chief Information Officer in accordance with 48 C.F.R. 4 § 249.7304. In addition to CDAO possessing the relevant authorities, CDAO and my office are Do W's 5 subject matter experts for Al issues and are therefore best able to provide the comprehensive risk 6 assessment that informs the determinations under Section 3252. As appropriate, my office and CDAO 7 also coordinate AI risk assessments with the Chief Information Officer. 8 Supply Chain Risk and Harms to National Security 9 9. As outlined in the Urgent Supply Risk Analysis (the "Analysis") provided to the 10 Secretary of War, Anthropic PBC has become a supply chain risk following a progression of risk that 11 reached a saturation point as a result of the behavior of its leadership during the course of contract 12 negotiations with Do W in late 2025 and early 2026. As explained in the Analysis, the relatively opaque 13 nature of large language model (LLM) technology that Do W procures from Anthropic creates a 14 baseline risk. That risk escalated due to the unusual degree of control that Anthropic retains over the 15 model, as well as Anthropic's adversarial posture towards Do W's statutory mission and the manner in 16 which it is conducted. This technical opacity makes it difficult for Do W to assess technological 17 features that may be encoded into the LLM product and that may cause it to subvert the appropriate 18 execution of mission applications, also known as "model poisoning," or to fail to perform altogether. 19 While this is, at least in part, a common concern with all LLMs, the risk is significantly elevated in this 20 instance by the actions of Anthropic's leadership, detailed below. 21 I 0. In addition, the federal government has identified AI as a field that requires technology 22 transfer restrictions, per the Technology Alert list. Anthropic employs a large number of foreign 23 nationals to build and support its LLM products, including many from the Peoples Republic of China 24 (PRC), which increases the degree of adversarial risk should those employees comply with the PRC's 25 National Intelligence Law. Although other major U.S. AI labs that provide LLM products to DoW may 26 present similar risks, the technical and security assurances of the other labs' leadership, along with their 27 consistently responsible and trustworthy behavior during their engagement with DoW, mitigate these 28 risks. Anthropic's case, however, is different. A series of additional risks came to light in 2026, when Case No. 3:26-cv-1996-RFL 3 Declaration of Emil Michael Case 3:26-cv-01996-RFL Document 96-3 Filed 03/17/26 Page 4 of 8 DoW and the company engaged in contract negotiations to expand Do W's use of Anthropic's LLM 2 products. 3 11. First, Anthropic's leadership demonstrated an intent to prevent the U.S. military's lawful 4 use of their LLM product, Claude, despite the company's publicly stated knowledge that adversarial 5 nation states have a practice of stealing Anthropic's LLM technology for their own unrestricted use. 2 6 This asymmetrical reality, imposed by Anthropic, disadvantages the U.S . military vis-a -vis its 7 adversaries. During the 2026 contract negotiations, Anthropic's leadership insisted on multiple redlines 8 that it would not allow the U.S. military to cross when using Claude. The company' s leadership 9 insisted on imposing restrictions on Do W's lawful military capability development, operations, and 10 intelligence missions, even though it would impair the capabilities of the U.S. military relative to our 11 adversaries. In short, Anthropic made clear that it will not allow the Government to deploy Claude for 12 multiple lawful uses. Determinations about lawful military uses, however, must rest solely with DoW 13 and not with a private company. 14 12. Second, Anthropic's leadership confirmed in an internal company memorandum 15 published in February that the company sought to impose multiple restrictions over the Government' s 16 lawful use of Claude, including safety mechanisms that may be outside the control of Do W. 3 17 13. Third, the company's leadership demonstrated bad faith by sharing with the press 18 unclassified but sensitive details of private conversations with Do W leadership in order to exert public 19 pressure on DoW to concede to Anthropic's demands. 20 14. Fourth, the Department learned that in 2025, the U.S. Centers for Disease Control's 21 (CDC) lawful use of Anthropic's LLM technology to support its infectious disease prevention research 22 mission was limited by Anthropic's use of safety filters in the LLM product CDC was using. The 23 company did not inform the agency of these filters, and they caused the product to stop functioning 24 normally for various sensitive, but research-aligned queries. 25 26 27 2 https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks. 3 https://www.theinformation.com/artic les/read-anthrop ic-ceos-memo-attacking-openais-mendacious- 28 pentagon-announcement. Case No. 3:26-cv-l 996-RFL 4 Declaration of Emil Michael Case 3:26-cv-01996-RFL Document 96-3 Filed 03/17/26 Page 5 of 8 15. Fifth, the Department learned that during an active overseas military operation, an 2 Anthropic executive expressed concern to one of Do W's primary operational support software vendors 3 about the potential use of Anthropic's LLM products by U.S. military analysts during the operation. 4 The Department was made aware of this conversation between cleared individuals by the primary 5 vendor. During later discussions with Anthropic leaders, not all of whom have the requisite security 6 clearances, an Anthropic executive repeated this information raising serious concerns about their 7 processes and procedures for operational security. The same information subsequently appeared in the 8 news media. In light of these incidents, it is reasonably likely that Anthropic's leadership would alter or 9 even shut off Do W's use of Claude if Anthropic believes that the model may be used for purposes it 10 deems, in its sole discretion, to extend beyond the company's unilaterally imposed boundaries before or 11 during a military operation, which could endanger the lives of U.S. military personnel and civilians and 12 compromise the United States' warfighting mission. Continuing to use Anthropic's technology under 13 the current contract structures in any echelon in Do W's supply chain, namely the covered systems, thus 14 presents a significant risk. 15 16. Taken together, this collection of risks demonstrates the clear technical capability and 16 adversarial intent for Anthropic's leadership to potentially undermine lawful U.S. national security 17 activities and objectives. Anthropic leadership's adversarial behavior has elevated the supply chain 18 risks to a saturation point. Do W uses Anthropic' s model in multiple ways, including in ongoing 19 military operations. If Anthropic were to interfere during an operation, whether by shutting off access 20 to the model or altering its functionality, such interference could cause serious harm to national security 21 and loss of human life. This risk within a covered system is intolerable and warrants the designation 22 under 10 U.S.C. § 3252. 23 17. This risk is not limited only to Anthropic and its model's standalone presence in DoW 24 systems or as a subcontractor to DoW. The model's interactions with other technology and covered 25 systems create additional risk to the DoW supply chain. When Anthropic's model is layered into other 26 applications, there is a substantial risk that any company-imposed restrictions or alterations to the 27 model would be transferred and impact mission applications, including in weapons systems 28 development and other products or services that ultimately perform Do W activities. Case No. 3:26-cv-1996-RFL 5 Declaration of Emil Michael Case 3:26-cv-01996-RFL Document 96-3 Filed 03/17/26 Page 6 of 8 18. As an example, if Anthropic's technology is used as a plug-in to a larger application, it 2 may limit the functionality of that larger system to the internal limitations built into or added to the 3 Anthropic system. This would directly impair other covered systems by reducing their functionality to 4 the same level as Anthropic's system. 5 19. AI is functionally a tool to assist Do W in its national security mission. It is imperative 6 that Do W be able to fully trust the functionality of its tools. Here, there are significant concerns due to 7 Anthropic's demonstrated willingness to modify or restrict its model's functionality for DoW purposes. 8 All lawfulness determinations are vested with DoW, which ensures the integrity of the chain of 9 command, especially during active combat operations. Anthropic's demonstrated willingness to 10 interfere with that chain of command is a significant risk. 11 20. In assessing these significant supply chain risks and harms to national security, DoW 12 considered whether less restrictive means than exclusion and removal could mitigate the supply chain 13 risk and national security harm. While each risk identified above may not, standing alone, have 14 necessitated exclusion and removal of plaintiff from Do W's supply chain, when considered in the 15 aggregate, a significant supply chain risk exists. The only potential mitigation to this collective set of 16 risks-acquisition of LLM products with the usage terms and technical and service delivery 17 specifications Do W requires-was not an option to which Anthropic would agree. 18 21. These risks and possible mitigation options were considered in the aggregate and in light 19 of the escalating tension over the key differences concerning authority to determine Do W's lawful use 20 of Claude during Do W's contract negotiations with Anthropic. Do W ultimately determined that 21 Anthropic' s conduct constituted a fully mature and significant supply chain risk-including increased 22 potential for AI model manipulation, insider threat risk, data exfiltration, and denial of service-that 23 posed a direct, unmitigable risk to Do W's warfighting capabilities and national security mission. 24 22. While Anthropic presents a supply chain risk, it is technically and operationally 25 infeasible to remove the technology from all DoW systems immediately, particularly in the midst of 26 active operations. Because of this reality, the designation allows a 180-day offramp to remove 27 Anthropic's Claude model from its systems and migrate to alternative LLM products without impacting 28 operational readiness. This is a significantly compressed timeline to ensure that this risk is removed Case No. 3 :26-cv-l 996-RFL 6 Declaration of Emil Michael Case 3:26-cv-01996-RFL Document 96-3 Filed 03/17/26 Page 7 of 8 from Do W's systems, particularly because of the need to integrate another vendor's products and 2 services, including the associated requisite security clearance. 3 23. This reality is expressed in a March 5, 2026, memorandum issued by the DoW Chief 4 Information Officer. In this memorandum, the Chief Information Officer determined that "DoW 5 Components will discontinue all use of the Covered Company's products across all Do W systems 6 within 180 days." The memorandum adds that new procurements involving Anthropic's products are 7 disallowed, as these products are no longer authorized for installation in Do W covered systems. 8 24. As noted, Claude is used in a variety of functions throughout DoW. This is a result of 9 Claude being the first Al model that was available to function in Do W's classified networks and one of 10 the first AI models integrated through Amazon Web Services (A WS), which was awarded the first 11 contract in 2016. This placed Claude in the lead on multiple fronts. However, other companies have 12 been closing the gaps. 13 25. DoW expects that within 180-days, barring any significant change in necessity, it will be 14 able to create the digital space needed for another system and prepare for a seamless handoff from 15 Claude to ensure that the risk is efficiently removed from Do W networks. 16 26. This process has already been initiated. An injunction pausing this process would in and 17 of itself be a significant threat to the national security of the United States. 18 27. An injunction preventing the removal of Anthropic's technology from DoW systems as 19 soon as possible would result in an ongoing threat to national security remaining on Do W's systems, 20 and allowing contractors to continue to engage with Anthropic as a subcontractor to DoW would itself 21 create an additional intolerable risk. As a subcontractor, Anthropic poses the same threats as it would 22 as a prime contractor. The incorporation of Anthropic's systems into a product on DoW systems would 23 cause the same risks regardless of whether it flows directly to Do W systems or through a prime 24 contractor. 25 28. During this transition period, Do W is taking additional measures to mitigate the supply 26 chain risk and national security harms presented by Anthropic leadership's behavior with regard to 27 DoW systems. The Department is working with third-party cloud service providers to ensure Anthropic 28 leadership cannot make unilateral changes to the containerized version of its LLM product that Do W Case No. 3 :26-cv-1996-RFL 7 Declaration of Emil Michael Case 3:26-cv-01996-RFL Document 96-3 Filed 03/17/26 Page 8 of 8 currently uses. DoW is also working with its counterintelligence and law enforcement partners to 2 assess the potential risk that Anthropic's LLM products may contain technical exploits, including ones 3 that could have been embedded by foreign nationals, given the leadership 's pattern of behavior. 4 Finally, DoW is communicating its risk saturation findings with the other U.S. government departments 5 and agencies to support their own risk mitigation efforts. 6 29. Do W has an obligation and a duty to ensure the integrity of its operations and the safety 7 and security of its personnel, including from any risks that may be presented through its supply chain to 8 its covered systems. Supply chain security is national security. Therefore, the Department took action 9 to ensure the integrity of its covered systems. IO I declare under penalty of perjury that the foregoing is true and correct. 11 EXECUTED this 17th day of March, 2026, at Washington, DC. 12 13 Emil Michael 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Case No. 3:26-cv-1996-RFL 8 Declaration of Emil Michael Newsletter Sign up to receive the Free Law Project newsletter with tips and announcements. Subscribe