Preliminary Injunction Framework

Key Findings

I. The Governing Standard: Winter v. NRDC (2008)

Under Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008), a plaintiff seeking a preliminary injunction must demonstrate: (1) a likelihood of success on the merits; (2) a likelihood of suffering irreparable harm in the absence of preliminary relief; (3) that the balance of equities tips in the plaintiff's favor; and (4) that an injunction is in the public interest.^[1]

The D.C. Circuit applies a "sliding scale" approach in which a stronger showing on one factor may offset a weaker showing on another, though all four must be addressed. Nken v. Holder, 556 U.S. 418 (2009), applies substantially similar factors for stays pending appeal.^[2]

II. Factor 1: Likelihood of Success on the Merits

This is the strongest factor. Anthropic can demonstrate likelihood of success on multiple independent legal theories, any one of which suffices:

Theory A: APA — Procedural Deficiency

The designation was made without the procedures required by 10 U.S.C. § 3252: no written determination, no "less intrusive measures" finding, no congressional notification with risk assessment summary. Under 5 U.S.C. § 706(2)(D), a court "shall ... set aside agency action ... without observance of procedure required by law."^[3]

This is the cleanest theory — it requires no novel legal doctrines. It asks only whether the government followed its own statute. The answer, based on the documented record, is no. See Statutory Analysis § II.

Federal courts have recently granted preliminary injunctions on analogous grounds — blocking DOGE access to Social Security Administration systems and OPM records where required procedures were not followed.^[4]

Theory B: APA — Ultra Vires

The designation exceeds § 3252's statutory authority: (1) Anthropic is not an "adversary" as defined by the statute; (2) the "any commercial activity" ban exceeds the statute's scope, which is limited to "covered procurement actions." Peter Harrell (Georgetown/former NSC) stated the Department of War "can't legally tell contractors don't use Anthropic in private contracts."^[5] See Statutory Analysis § II.

Theory C: Equal Protection — Class of One

Under Village of Willowbrook v. Olech, 528 U.S. 562 (2000), Anthropic need only show it was "intentionally treated differently from others similarly situated" with "no rational basis." OpenAI's deal contained the same restrictions — yet Anthropic was designated a threat while OpenAI was rewarded, hours apart.^[6] See Constitutional Analysis § III.

Theory D: First Amendment Retaliation

Under Umbehr (1996), the First Amendment protects independent contractors from retaliation for speech. Trump's own words — "Leftwing nut jobs," "Full Power of the Presidency" — provide direct evidence of retaliatory animus.^[7] See Constitutional Analysis § I.

Theory E: Due Process

Under Mathews v. Eldridge (1975), the absence of any procedural protections — no notice, no hearing, no opportunity to respond before a designation announced via social media — fails all three prongs when weighed against the magnitude of the private interest.^[8] See Constitutional Analysis § IV.

Summary

Five independent theories. The procedural APA theory is virtually airtight as the lead vehicle. Even if a court were skeptical of the constitutional theories, the statutory/APA grounds independently establish likelihood of success.

III. Factor 2: Irreparable Harm

Constitutional Harm = Per Se Irreparable

The loss of First Amendment rights, for even minimal periods, constitutes irreparable injury under established precedent. The designation chills Anthropic's speech rights — and the speech rights of every government contractor watching — in ways that cannot be compensated by money damages. The Equal Protection violation is similarly irreparable; ongoing differential treatment cannot be remedied retroactively.

Economic Harm Not Compensable by Money Damages

Anthropic faces: (1) loss of a $200M Pentagon contract; (2) a government-wide ban on its products; (3) a mandate that all military contractors sever "any commercial activity" with Anthropic; (4) damage to a $30B funding round and IPO preparation; and (5) reputational harm across the commercial sector.^[5]

These economic harms are not compensable through money damages because the government enjoys sovereign immunity absent a waiver. The only remedy is equitable — enjoining the designation itself.

Harm Is Ongoing and Accelerating

The six-month phase-out means harm compounds daily as contractors sever ties. Each day without injunctive relief means more relationships terminated, more customers lost, more damage that cannot be undone even if Anthropic ultimately prevails.

IV. Factor 3: Balance of Equities

The Government's Own Timeline Defeats Its Urgency Claim

The single most powerful equity argument: the government itself established a six-month transition period. If Claude genuinely posed a supply chain risk comparable to Kaspersky or Huawei, the government would not have allowed six months of continued use. The extended timeline demonstrates that a preliminary injunction maintaining the status quo during litigation would not harm the government's interests.

Government Equities Are Minimal

What would the government lose from a preliminary injunction? The Pentagon would continue using Claude under the existing contractual framework — the same arrangement that has been in place since June 2024, that supported classified operations, and that the government itself found essential enough that defense officials privately described disentangling as a "huge pain in the ass."^[9] The status quo ante is continued use of technology the Pentagon relies on.

Anthropic's Equities Are Existential

Without an injunction, Anthropic faces potential destruction of its commercial relationships, devastation of its funding round, and permanent reputational damage. The asymmetry is stark: the government loses nothing from maintaining the status quo; Anthropic loses everything from the designation proceeding.

V. Factor 4: Public Interest

Protecting Constitutional Rights

The public interest always favors protecting First Amendment rights and the rule of law. A designation that punishes a company for exercising its right to refuse government demands — particularly demands related to mass surveillance and autonomous weapons — sets a precedent that chills the speech of every entity contracting with the government.

Preventing the Chilling Effect

The "any commercial activity" ban means every defense contractor must choose between doing business with the Pentagon and maintaining a relationship with Anthropic. This creates a chilling effect across the entire defense industrial base and beyond, to any company that might consider negotiating contractual terms with the government.

Senator Slotkin observed that "Congress has not put clear limits around AI's use in the military" — implying these are legislative questions.^[10] Senator Markey called the designation "reckless and unprecedented."^[11] These bipartisan concerns underscore that the public interest lies in judicial rather than executive resolution.

National Security Cuts Both Ways

National security also favors: (1) maintaining the only AI model currently operational on classified networks; (2) preserving AI safety guardrails against mass surveillance and autonomous weapons; and (3) preventing the precedent that supply chain risk designations can be weaponized against domestic companies for ideological reasons.

As Rozenshtein noted, there is a fundamental contradiction in simultaneously designating Anthropic a "supply chain risk" while arguing its technology is so essential that the government must compel access via the DPA.^[12]

VI. Anticipated Government Defenses

National Security Deference

Courts give deference to genuine national security determinations. But that deference does not extend to: (a) claims that bypass required statutory procedures; (b) designations that exceed statutory authority; or (c) actions motivated by retaliatory animus rather than legitimate security concerns. The Supreme Court in TikTok Inc. v. Garland (2025) applied intermediate scrutiny even to a Congressionally-authorized national security action involving a foreign adversary with documented state ties — far more process than occurred here.^[13]

Political Question Doctrine

The designation raises legal questions — statutory compliance, constitutional rights — that are quintessentially judicial. The government's decision is reviewable under the APA; only purely military operational decisions enjoy political question insulation.

Sovereign Immunity

Anthropic should frame its claims as equitable — injunction against unconstitutional/ultra vires action — rather than contractual damages. The APA waives sovereign immunity for challenges to agency action under 5 U.S.C. § 702.^[3]

VII. Procedural Strategy

Recommended Filing Sequence

Emergency TRO motion (filed simultaneously with complaint): Seek immediate temporary restraining order to preserve the status quo. Ground the TRO in the procedural APA theory (cleanest, fastest) plus the irreparable harm showing.

Preliminary injunction briefing (expedited schedule): Full four-factor briefing incorporating all five legal theories. Request expedited hearing given the ongoing, accelerating harm.

Venue considerations: D.C. District Court (where APA challenges against federal agencies are typically filed, with extensive D.C. Circuit APA precedent) or Northern District of California (Anthropic's headquarters, with potentially favorable Ninth Circuit precedent on technology company rights).

Stay-Factor Alignment

Under Nken v. Holder, the stay factors mirror the PI factors. If the court grants a preliminary injunction, the same analysis supports a stay if the government appeals. This alignment means an initial PI victory creates strong precedent for maintaining relief through appellate review.^[2]

VIII. The Integrated Case

The full research portfolio forms an interlocking evidentiary and legal framework:

The Verified Timeline provides the factual foundation — every legal argument rests on timestamped, sourced facts. The Government Vulnerability Analysis maps where the government's position is weakest. The Statutory Analysis establishes the cleanest, most conservative grounds for relief. The Constitutional Analysis provides the deepest grounds that elevate irreparable harm and public interest. This PI Framework integrates all four into the standard the court will actually apply.

The case is deliberately constructed so that no single theory is necessary for relief. The statutory claims suffice without reaching constitutional questions. The constitutional claims provide independent grounds if the government finds a way to moot the statutory arguments. The equal protection claim stands independent of the First Amendment claim. Each theory reinforces the others while remaining independently sufficient.

This architecture also hedges against the possibility that the government may abandon its current statutory vehicle and pivot to new legal theories. The constitutional claims — particularly First Amendment retaliation and equal protection — survive regardless of which statutory vehicle the government invokes, because they attach to the government's conduct, not its legal theory.