On April 2, the U.S. Court of Appeals for the District of Columbia Circuit held that the definition of “critical infrastructure” that the Federal Communications Commission (FCC) had devised under the Secure Equipment Act (SEA) was “overly broad.” The U.S. subsidiaries of Hikvision USA, Inc. (Hikvision) and Dahua Technology USA Inc. (Dahua) had sued the FCC and the U.S. government, challenging their inclusion on the FCC’s “Covered List.”

The DC Circuit’s bottom line favored the challengers. These companies, the DC Circuit started out by observing, “manufacture video cameras and video-surveillance equipment.” And Congress, like the FCC, had been concerned that such “communications equipment … poses a threat to U.S. national security.” So by enacting the SEA, Congress instructed “the FCC to no longer approve any equipment on the Covered List for marketing or sale within the United States.” Pursuant to the SEA, the FCC issued an order prohibiting the sale or marketing of Hikvision’s and Dahua’s products when they are being deployed “for the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.” The crux of the court’s decision hinged on the meaning of “critical infrastructure” as relied upon by the FCC.

Certain highlights of the DC Circuit’s important decision are as follows:

• First, “when Congress referred to the [FCC’s] Covered List in the SEA without questioning or discussing the makeup of that list, Congress affirmatively ratified the Covered List as it existed at the time of the SEA’s passage.”
• The court came to that conclusion because, in its words, Congress “plainly was aware that Petitioners’ equipment was on the Covered List.” The DC Circuit reasoned: “Not only was the list publicly available, but Congress itself identified Petitioners’ products as national-security risks in the [National Defense Authorization Act (NDAA) and then … made that determination relevant to the FCC’s decision whether to place certain communications equipment on the Covered List.” According to the court, Congress effectively had ratified that Covered List — and Hikvision’s and Dahua’s places in them.
• The DC Circuit also noted that “to the extent that there is any ambiguity, the national-security judgments and concerns underlying the Executive Branch’s decision in this case counsel deference” to that branch of the federal government.
• Second, the DC Circuit also determined that the FCC’s “interpretation is unjustifiably broad and is therefore arbitrary and capricious” under the Administrative Procedure Act (APA).
• Importantly, in the court’s view, “the definition of ‘critical infrastructure’ ultimately adopted by the FCC includes any ‘systems or assets’ that are merely ‘connected to’ the sixteen sectors identified by the [Presidential Policy Directive 21] or the fifty-five functions listed by the [Cybersecurity and Infrastructure Security Agency] risk-management guide.”
• In addition, “the FCC’s definition” was deemed by the DC Circuit to “fail[] to provide comprehensible guidance about what falls within the bounds of ‘critical infrastructure.’”

The DC Circuit’s decision rejected what it viewed as the FCC’s open-ended and amorphous formulation that put Dahua and Hikvision, along with other entities, on the Covered List. Both the governing decision-makers and the governed and covered entities would not readily know who was covered and why. Where would the line be drawn in a principled manner? Surely, logical articulation rather than agency guesswork should be deployed for the order to pass muster under the APA, the DC Circuit reasoned.

Doubtless, the court’s decision could have been broader. And now the FCC can go back to the drawing board and define “critical infrastructure” — specifically, the “connected to” expression — more clearly. This decision does not constrain the FCC in any significant or long-lasting way from achieving its objectives. A strategically surgical deployment of the “critical infrastructure” usage could cure the deficiencies identified by this DC Circuit decision. Other, more macro concerns, those of a constitutional magnitude (especially non-delegation), with the FCC order might remain in the eyes of many jurists.¹

---

¹See, e.g., Gundy v. United States, 139 S. Ct. 2116, 2131 (2019) (Gorsuch, J., dissenting) (“The Constitution promises that only the people’s elected representatives may adopt new federal laws restricting liberty.”); id. at 2133 (Gorsuch, J., dissenting) (“[T]he framers understood [the constitutionally-endowed legislative power] to mean the power to adopt generally applicable rules of conduct governing future actions by private persons — the power to ‘prescrib[e] the rules by which the duties and rights of every citizen are to be regulated,’ or the power to ‘prescribe general rules for the government of society.’”) (quoting The Federalist No. 78, p. 465 (C. Rossiter ed. 1961) (A. Hamilton), and Fletcher v. Peck, 10 U.S. (6 Cranch) 87, 136 (1810)).