United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT
Argued December 14, 2023 Decided April 2, 2024
No. 23-1032
HIKVISION USA, INC., PETITIONER
v.
FEDERAL COMMUNICATIONS COMMISSION AND UNITED STATES OF AMERICA, RESPONDENTS
MOTOROLA SOLUTIONS, INC., INTERVENOR
Consolidated with 23-1073
On Petitions for Review of an Order of the Federal Communications Commission
Christopher J. Wright and Russell M. Blau argued the causes for petitioners. With them on the joint briefs were Andrew D. Lipman, Timothy J. Simeone, John T. Nakahata, John R. Grimm, Deepika H. Ravi, Annick Banoun, James M. Cole, and Tobias S. Loss-Eaton. 2 Matthew J. Dunne, Counsel, Federal Communications Commission, argued the cause for respondents. With him on the brief were Brian M. Boynton, Principal Deputy Assistant Attorney General, U.S. Department of Justice, Sharon Swingle and Casen Ross, Attorneys, Jacob M. Lewis, Deputy General Counsel, Federal Communications Commission, and Sarah E. Citrin, Deputy Associate General Counsel.
Thomas M. Johnson Jr. argued the cause for intervenor in support of respondents. With him on the brief were Bennett L. Ross and Michael J. Showalter.
Before: MILLETT and PAN, Circuit Judges, and RANDOLPH, Senior Circuit Judge.
Opinion for the Court filed by Circuit Judge PAN.
PAN, Circuit Judge: Hikvision USA, Inc. (“Hikvision”) and Dahua Technology USA Inc. (“Dahua”) (collectively, “Petitioners”) are two Chinese-owned companies that manufacture video cameras and video-surveillance equipment. In March 2021, the Federal Communications Commission (“FCC”) relied on a congressional finding to place Petitioners’ products on the “Covered List” — a list of communications equipment that poses a threat to U.S. national security. Later that year, in November 2021, Congress passed the Secure Equipment Act (“SEA”), which directed the FCC to no longer approve any equipment on the Covered List for marketing or sale within the United States. The FCC issued an order to implement the equipment ban mandated by the SEA. The ban applies to Petitioners’ video-surveillance equipment to the extent that it is used for certain purposes, including “physical security surveillance of critical infrastructure.” 3 Petitioners challenge the FCC’s implementing Order, arguing that Petitioners’ products do not belong on the Covered List and therefore should not be barred from U.S. markets. We hold that the SEA ratified the composition of the Covered List and leaves no room for Petitioners to challenge the placement of their products on that list under a predecessor statute. But we agree with Petitioners that the FCC’s definition of “critical infrastructure” is overly broad. We therefore deny the petitions in part and grant them in part.
I.
Petitioners Hikvision and Dahua are U.S. subsidiaries of Chinese manufacturers of video equipment. In the United States, Petitioners’ cameras are used by small- and medium- sized business owners to secure their premises. Industry commenters have expressed concern in FCC rulemakings that Petitioners’ equipment could be utilized by the Chinese government to spy on sensitive American infrastructure and could pose other national-security risks. As a result, Petitioners’ products have been specifically identified and addressed by both Congress and the FCC.
A.
In the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (“NDAA”), Congress prohibited federal agencies from using or procuring certain “covered” technology sold by Chinese companies. Pub. L. No. 115-232, § 889, 132 Stat. 1636, 1917–19 (2018). The NDAA specifically targeted Petitioners’ products for this limited ban from federal procurement. Section 889(f)(3) of the NDAA defines “covered telecommunications equipment” to include “video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company” that 4 is used “[f]or the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.” Id. at § 889(f)(3). Although the statute specifically names Petitioners’ parent companies, the NDAA also applies to “any subsidiary or affiliate of such entities.” Id.
Congress followed up in March 2020 by passing the Secure and Trusted Communications Networks Act (“SNA”). Pub. L. No. 116-124, 134 Stat. 158. The SNA instructed the FCC to create the Covered List, i.e., to “publish on its website a list of covered communications equipment or services.” 47 U.S.C. § 1601(a). The SNA also banned the use of FCC subsidies to purchase any equipment on the Covered List. Id. § 1602(a)(1). Equipment is designated as “covered” and “shall [be] place[d] on the list” if it “poses an unacceptable risk to the national security of the United States or the security and safety of United States persons.” Id. § 1601(b)(1).1 Section 1601(c) of the SNA requires the FCC to rely on four types of national- security determinations to place products on the Covered List. One of those determinations is the definition of “covered telecommunications equipment” under the NDAA. Id. § 1601(c)(3) (The Commission “shall place on the list” any equipment that “poses an unacceptable risk to national security . . . based solely on” such equipment “being covered telecommunications equipment or services, as defined in
1 The equipment also must be “capable of” certain functions, including “routing or redirecting user data traffic or permitting visibility into any user data or packets,” “causing the network of a provider of advanced communications service to be disrupted remotely,” or “otherwise posing an unacceptable risk to the national security of the United States or the security and safety of United States persons.” 47 U.S.C. § 1601(b)(2). 5 section 889(f)(3) of the [NDAA].”).2 The SNA requires the FCC to periodically update the Covered List, and specifically contemplates that communications equipment or services may be added or removed from the list. Id. § 1601(d); 47 C.F.R. §§ 1.50002, 1.50003 (implementing SNA).
In December 2020, the FCC began implementing the requirements of the SNA by issuing the Supply Chain Second Order. That Order established procedures and criteria for compiling the Covered List, including a “requirement to accept determinations” of national-security risk by certain sources. Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs, WC Docket No. 18-89, Second Report and Order (Supply Chain Second Order), 35 FCC Rcd. 14284, paras. 13, 58–71 (2020). One mandatory source was the section of the NDAA in which Congress determined that Petitioners’ equipment posed national-security risks when used for listed purposes. Supply Chain Second Order, at paras. 66–71.
On March 12, 2021, the FCC officially published the Covered List, which included Petitioners’ “[v]ideo surveillance and telecommunications equipment.” Public Safety and Homeland Security Bureau Announces Publication of the List of Equipment and Services Covered by Section 2 of the Secure
2 The other qualifying determinations include: (i) “A specific determination made by any executive branch interagency body with appropriate national security expertise, including the Federal Acquisition Security Council established under section 1322(a) of title 41”; (ii) “A specific determination made by the Department of Commerce pursuant to Executive Order No. 13873 (84 Fed. Reg. 22689; relating to securing the information and communications technology and services supply chain)”; and (iii) “A specific determination made by an appropriate national security agency.” 47 U.S.C. §§ 1601(c)(1)–(2), (4). 6 Networks Act, WC Docket No. 18-89, Public Notice, DA 21- 309 (PSHSB, Mar. 12, 2021). In keeping with the statutory text of the NDAA, the Covered List included Petitioners’ technology only “to the extent it [was] used for the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.” Id. As a result of Petitioners’ inclusion on the Covered List, federal subsidies administered by the FCC could no longer be used to purchase Petitioners’ products for listed purposes. See 47 U.S.C. § 1602(a)(1); Supply Chain Second Order, at para. 94.
B.
Under the Communications Act, the FCC is authorized to regulate devices that emit radiofrequency energy that could interfere with radio communications. 47 U.S.C. § 302a(a). In carrying out its regulatory responsibilities, the FCC has utilized an equipment-authorization program to ensure that radiofrequency-emitting devices comply with the FCC’s requirements before they can be marketed in or imported into the United States. See 47 C.F.R. Part 2 Subpart I, § 2.801 et seq. (Marketing of Radio Frequency Devices); 47 C.F.R. Part 2 Subpart J, § 2.901 et seq. (Equipment Authorization Procedures); 47 C.F.R. Part 2 Subpart K, § 2.1201 et seq. (Importation of Devices Capable of Causing Harmful Interference).
In June 2021, the FCC issued a Notice of Proposed Rulemaking (“NPRM”) that proposed banning the authorization of equipment on the Covered List. In the NPRM, the Commission sought comments on “various steps that [it] could take in its equipment authorization program . . . to reduce threats posed to our nation’s communications system.” J.A. 37. The FCC contemplated revising the equipment-authorization 7 rules to “prohibit authorization of any ‘covered’ equipment on the Covered List.” Id. Petitioners were named on the first page of the NPRM’s “Discussion” section as companies to whom the proposed ban would apply in some degree. After the NPRM’s issuance, the FCC received a host of comments, some of which expressed uncertainty about whether the Secure Networks Act, the Communications Act, or any other statute empowered the FCC to ban equipment authorizations due to national-security concerns. Petitioners filed comments arguing that the FCC lacked statutory authority to promulgate the proposed rule.
Five months later, in November 2021, Congress passed the Secure Equipment Act. Pub. L. No. 117-55, 135 Stat. 423. The SEA directed the Commission to “adopt rules in the proceeding initiated” in the NPRM and specifically identified the NPRM by docket number. Id. at § 2(a)(1). In section 2(a)(2) of the SEA, Congress required the Commission to “no longer review or approve any application for equipment authorization for equipment that is on the [Covered List],” i.e., “the list of covered communications equipment or services published by the Commission under” the Secure Networks Act. Id. at § 2(a)(2). Congress referred to the Covered List without commenting on its composition or altering its existing scope. Id.
A year later, in November 2022, the FCC issued the Order that Petitioners now challenge. As mandated by Congress in the SEA, the Order promulgates the rule contemplated by the NPRM: It bans equipment authorizations for “covered” equipment. The Order’s ban applies to products on the Covered List, including video surveillance and telecommunications equipment manufactured by Petitioners Hikvision and Dahua, to the extent that such equipment is used for “the purpose of public safety, security of government 8 facilities, physical security surveillance of critical infrastructure, or other national security purposes.” J.A. 186. Petitioners’ products will not be authorized for sale in the United States “until such time as the Commission approves these entities’ plans and measures . . . to ensure [that] such equipment will not be marketed and sold” for prohibited purposes. Id.
The Order also provides further guidance about when equipment is used for “physical security surveillance of critical infrastructure.” In defining “critical infrastructure,” the FCC cited several sources. First, the Commission “appl[ied] the meaning” provided by section 1016(e) of the USA PATRIOT Act of 2001 (“the Patriot Act”), which defines “critical infrastructure” as “‘systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.’” J.A. 210 (quoting 42 U.S.C. § 5195c(e)). Next, the Commission noted that Presidential Policy Directive 21 (“PPD-21”) identifies sixteen critical infrastructure economic sectors;3 and that the Cybersecurity and Infrastructure Security Agency (“CISA”), through the National Risk Management Center (“NRMC”), has published a set of fifty-five National Critical Functions to “guide national risk management
3 The sixteen critical infrastructure sectors identified in PPD-21 are “chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government facilities, health care and public health, information technology, nuclear reactors/materials/waste, transportation systems, and water/waste water systems.” J.A. 210–11. 9 efforts.”4 J.A. 210–11 & nn. 527 & 529 (citing Directive on Critical Infrastructure Security and Resilience, 1 Pub. Papers 106, 115 (Feb. 12, 2013); National Risk Management Center, Cybersecurity and Infrastructure Security Agency, National Critical Functions Status Update to the Critical Infrastructure Community 2–8 (2020)).
After observing that the CISA/NRMC guide adopts a definition of National Critical Functions that is similar to the Patriot Act’s definition of critical infrastructure, the FCC found that, for the purposes of implementing the Order, “any systems or assets, physical or virtual, connected to the sixteen critical infrastructure sectors identified in PPD-21 or the 55 [National Critical Functions] identified in [the] CISA/NRMC [risk management guide] could reasonably be considered ‘critical infrastructure.’” J.A. 211 (emphasis added). The Order then notes that the agency will continue to “develop further clarifications to inform applicants for equipment authorizations” and provide “more specificity and detail.” Id.
4 The CISA is a component of the Department of Homeland Security that seeks to defend against risks to physical and digital infrastructure. About CISA, CISA, https://perma.cc/KXP5-D5FZ (last visited Mar. 13, 2024). The NRMC is a center within CISA that focuses on strategic risk reduction, including initiatives to reduce risks in 5G technology, election security, pipeline cybersecurity, and more. National Risk Management Center Fact Sheet, CISA, https://perma.cc/YP53-E96G (last visited Mar. 13, 2024). The CISA/NRMC National Critical Functions Set includes activities such as “provid[ing] cable access network services,” “distribut[ing] electricity,” “conduct[ing] elections,” “provid[ing] metals and materials,” and “supply[ing] water.” National Risk Management Center, Cybersecurity and Infrastructure Security Agency, National Critical Functions Status Update to the Critical Infrastructure Community 2–8 (2020) (capitalization altered throughout). 10 Petitioners timely filed their petitions for review of the November 2022 Order. We have jurisdiction under 28 U.S.C. § 2342(1) and 47 U.S.C. § 402(a).
II.
Under the Administrative Procedure Act, a court must set aside agency action that is arbitrary, capricious, an abuse of discretion, or otherwise contrary to law. 5 U.S.C. § 706(2)(A). “In the absence of statutory authorization for its act, an agency’s action is plainly contrary to law and cannot stand.” Atlantic City Elec. Co. v. FERC, 295 F.3d 1, 8 (D.C. Cir. 2002) (cleaned up); see also Ball, Ball & Brosamer, Inc. v. Reich, 24 F.3d 1447, 1450 (D.C. Cir. 1994) (“An agency can neither adopt regulations contrary to statute, nor exercise powers not delegated to it by Congress.”). For an arbitrary-and- capriciousness challenge, “[a] court simply ensures that the agency has acted within a zone of reasonableness and, in particular, has reasonably considered the relevant issues and reasonably explained the decision.” China Telecom (Ams.) Corp. v. FCC, 57 F.4th 256, 265 (D.C. Cir. 2022) (alteration in original) (quoting FCC v. Prometheus Radio Project, 141 S. Ct. 1150, 1158 (2021)).
III.
The FCC Order at issue bans the authorization of Petitioners’ products for marketing and sale in the United States, to the extent that the products are used “for the purpose of . . . physical security surveillance of critical infrastructure.” J.A. 209. Petitioners challenge two aspects of the Order. First, Petitioners argue that the FCC exceeded the scope of its statutory authority when it placed Petitioners’ equipment on the Covered List. Second, Petitioners argue that the FCC’s definition of “critical infrastructure” is overbroad and inconsistent with the NDAA. We reject Petitioners’ claim that 11 their equipment does not belong on the Covered List, but we agree that the Commission’s definition of critical infrastructure is too broad.
The FCC’s Order implemented the Secure Equipment Act of 2021, in which Congress directed the FCC to no longer “review or approve any application for equipment authorization for equipment that is on [the Covered List].” Pub. L. No. 117-55, § 2(a)(2), 135 Stat. 423, 423. Petitioners’ video-surveillance and telecommunications equipment is on the Covered List — and was on it at the time Congress passed the SEA — and therefore is subject to the authorization ban. But Petitioners attempt to dispute the FCC’s prior decision to place their products on the Covered List, arguing that the FCC misconstrued the SNA at that earlier point in time. According to Petitioners, they may make this belated claim because, during the 2022 rulemaking that led to the promulgation of the Order, the FCC “[r]eopened” the definition of covered equipment under the SNA. Reply Br. 5 (citing Alvin Lou Media, Inc. v. FCC, 571 F.3d 1, 8 (D.C. Cir. 2009)). The government contends that we lack jurisdiction to review Petitioners’ untimely claim, which should have been made within 60 days of the disputed agency action (i.e., the initial publication of the Covered List). Resp. Br. 38 (citing 28 U.S.C. § 2344).
In our view, Petitioners’ argument does not implicate our jurisdiction. We have jurisdiction over this case because Petitioners timely filed petitions for review of the 2022 Order, contending that the Order’s equipment-authorization ban was improperly applied to their products. See 28 U.S.C. § 2344. Our refusal to reach the merits of Petitioners’ SNA argument is rooted not in jurisdictional concerns, but in our interpretation 12 of the SEA: The SEA ratified the composition of the Covered List at the time of the SEA’s enactment and thus precludes Petitioners from claiming that their products were improperly put on the list at an earlier point in time.
Congress has clearly expressed its view that Petitioners’ products pose a risk to national security in certain circumstances. It first did so in the NDAA, which prohibited executive agencies from procuring “video surveillance and telecommunications equipment produced by [Petitioners]” when used for certain purposes. Pub. L. No. 115-232, § 889(a), (f)(3), 132 Stat. 1636, 1917–18 (2018). Less than two years later, in the SNA, Congress directed the FCC to create a Covered List of equipment that “pose[s] an unacceptable risk to the national security of the United States,” 47 U.S.C. § 1601(b)(2)(c), including communications equipment that is also “covered telecommunications equipment . . . as defined in section 889(f)(3) of the [NDAA],” id. § 1601(c)(3). The FCC then placed Petitioners’ equipment on the Covered List and published the Covered List on its website. Public Safety and Homeland Security Bureau Announces Publication of the List of Equipment and Services Covered by Section 2 of the Secure Networks Act, WC Docket No. 18-89, Public Notice, DA 21- 309 (PSHSB, Mar. 12, 2021).
Against that backdrop, Congress took aim at Petitioners again in the Secure Equipment Act. The SEA was enacted in response to controversy over the FCC’s equipment- authorization NPRM. Congress passed the SEA to remove any doubt that the FCC was empowered to issue the equipment- authorization ban that Petitioners currently challenge. The SEA requires the FCC to promulgate the proposed rule that would ban authorizations for “equipment that is on the list of covered communications equipment . . . published by” the Commission. 135 Stat. at 423. As explained below, when 13 Congress directed the FCC to follow through on its NPRM and to prohibit the authorization of equipment that is on the Covered List, Congress was fully aware that (1) the NPRM specifically discussed Petitioners’ products in connection with the proposed ban, and (2) Petitioners’ products were on the Covered List. It appears, then, that when Congress passed the SEA, it intended to require the FCC to prohibit the marketing and sale of Petitioners’ products for listed purposes within the United States.
Section 2(a) of the SEA reads as follows:
(1) IN GENERAL.—Not later than 1 year after the date of the enactment of this Act, the Commission shall adopt rules in the proceeding initiated in the Notice of Proposed Rulemaking in the matter of Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program (ET Docket No. 21–232; FCC 21–73; adopted June 17, 2021), in accordance with paragraph (2), to update the equipment authorization procedures of the Commission.
(2) UPDATES REQUIRED.—In the rules adopted under paragraph (1), the Commission shall clarify that the Commission will no longer review or approve any application for equipment authorization for equipment that is on the list of covered communications equipment or services published by the Commission under section 2(a) of the 14 Secure and Trusted Communications Networks Act of 2019 (47 U.S.C. 1601(a)).
135 Stat. at 423.
Thus, subsection (1) identifies by docket number the NPRM in which the FCC proposed to ban authorizations of equipment on the Covered List: It orders the FCC to adopt rules pursuant to that specifically described NPRM. The NPRM referred to Petitioners, by name, as entities whose products would no longer be authorized for listed purposes. Meanwhile, subsection (2) mandates that the rules adopted in connection with the NPRM must carry out the FCC’s proposed ban of authorizations of equipment “that is on the list of covered communications equipment or services published by the Commission.” 135 Stat. at 423. Subsection (2) explicitly refers to the Covered List, which included Petitioners’ products at the time of the SEA’s passage.
The text and historical context of the SEA demonstrate that Congress incorporated the Covered List into the SEA, and thereby ratified the composition of the list. “[W]here . . . Congress adopts a new law incorporating sections of a prior law, Congress normally can be presumed to have had knowledge of the interpretation given to the incorporated law . . . .” Lorillard v. Pons, 434 U.S. 575, 581 (1978). But we need not rely on a presumption here because when Congress incorporated the Covered List into the SEA, it plainly was aware that Petitioners’ equipment was on the Covered List: Not only was the list publicly available, but Congress itself identified Petitioners’ products as national-security risks in the NDAA and then, in the SNA, made that determination relevant to the FCC’s decision whether to place certain communications equipment on the Covered List. See Jackson v. Modly, 949 15 F.3d 763, 773 (D.C. Cir. 2020) (noting that an indication of congressional acquiescence is “particularly strong if evidence exists of the Congress’s awareness of and familiarity with such an interpretation”). Moreover, the text of the SEA refers to the NPRM, which was explicit that Petitioners’ equipment would be subject to the proposed authorization ban. And the legislative history of the SEA includes a specific reference to Petitioners’ parent companies. See Memorandum from House Committee on Energy and Commerce Staff, re Full Committee Markup of 16 Health Bills and 8 Communications and Technology Bills at 7 (July 19, 2021) (“The [SEA] would prevent further integration and sales of Huawei, ZTE, Hytera, Hikvision, and Dahua — all Chinese state-backed or directed firms — in the United States regardless of whether federal funds are involved.”). In short, the evidence of Congress’s awareness of the contents of the Covered List could not be clearer.
Thus, when Congress referred to the Covered List in the SEA without questioning or discussing the makeup of that list, Congress affirmatively ratified the Covered List as it existed at the time of the SEA’s passage. See Bragdon v. Abbott, 524 U.S. 624, 631 (1998) (“Congress’ repetition of a well- established term carries the implication that Congress intended the term to be construed in accordance with pre-existing regulatory interpretations.”); cf. Forest Grove Sch. Dist. v. T.A., 557 U.S. 230, 239–40 (2009) (“Congress is presumed to be aware of an administrative or judicial interpretation of a statute and to adopt that interpretation when it re-enacts a statute without change.” (quoting Lorillard, 434 U.S. at 580)); Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 322–26 (2012) (discussing the 16 “prior-construction canon”).5 And when Congress targeted the Covered List for the equipment-authorization ban, it demonstrated its specific intent to prohibit the sale and marketing of Petitioners’ products in the United States for listed purposes.
The Supreme Court has found congressional ratification of agency actions and judicial interpretations in analogous situations. In Lorillard v. Pons, for example, the Supreme Court determined that when Congress enacted the Age Discrimination in Employment Act (“ADEA”) of 1967, it was aware of the prevailing judicial interpretations of the incorporated provisions of the Fair Labor Standards Act (“FLSA”). 434 U.S. at 580–82. Because “courts had uniformly afforded jury trials” under the enforcement provisions of the FLSA, the Court concluded that Congress intended that trials by jury would also be available under the ADEA. Id. at 585. Similarly, in Bragdon v. Abbott, the Court held that the Americans with Disabilities Act’s (“ADA”) definition of “disability” included individuals with HIV
5 The ratification doctrine is frequently discussed in the context of Congress’s reenactment of statutes. See Thompson v. Clifford, 408 F.2d 154, 164 (D.C. Cir. 1968) (“[T]he canon of statutory construction that reenactment without change after a course of administrative interpretation is tantamount to legislative ratification of the interpretation” rests on the reasoning “either that those in charge of the amendment are familiar with existing rulings, or that they mean to incorporate them.” (quotation marks omitted)); United States v. Bd. of Comm’rs of Sheffield, Ala., 435 U.S. 110, 135 (1978) (concluding that when “there had been a longstanding administrative interpretation of a statute when Congress re-enacted it, and . . . the legislative history of the re-enactment showed that Congress agreed with that interpretation, . . . Congress had ratified it”). The same principles apply with even greater force here, where Congress so clearly intended to incorporate the existing Covered List. 17 because the statute’s definition was drawn “almost verbatim” from the definition of “handicapped individual” in the Rehabilitation Act of 1973. 524 U.S. at 631. A 1988 Department of Justice Office of Legal Counsel (“OLC”) opinion had concluded that the Rehabilitation Act protected HIV-infected individuals. Id. at 642. The Court observed that “[a]ll indications are that Congress was well aware of the position taken by OLC when enacting the ADA and intended to give that position its active endorsement.” Id. at 645. Like in Lorillard and Bragdon, “all indications” here are that Congress was “well aware” of the legal and administrative landscape when it enacted the SEA; and we thus infer that Congress intended the equipment-authorization ban to apply to all products that were on the Covered List at that time. But see Public Citizen, Inc. v. HHS, 332 F.3d 654, 668–69 (D.C. Cir. 2003) (declining to find ratification where there was no evidence that Congress was aware of the relevant agency action).
Petitioners contend that the SEA addresses only the consequences of being on the Covered List, while the SNA addresses who should be on the List. They argue that, because their products do not meet the statutory definition of “communications equipment” in the SNA, they cannot properly be on the Covered List or be subject to the equipment- authorization ban. We disagree. Petitioners seek to challenge their placement on the Covered List, which occurred before Congress enacted the SEA. But when Congress specified in the SEA that equipment on the Covered List would no longer be eligible for authorizations, Congress required that the ban would apply to Petitioners’ equipment. Petitioners’ objection to their inclusion on the Covered List under the SNA is thus foreclosed by Congress’s “affirmative ratification of the [FCC’s] administrative interpretation[]” of the content of the list. Bragdon, 524 U.S. at 646. 18 In sum, the 2022 Order implemented the SEA, which ratified the inclusion of Petitioners’ products on the Covered List. Because Congress intended the FCC to ban the authorization of any equipment that was on the Covered List at the time of the SEA’s enactment, Petitioners’ claim that the FCC erred when it first placed Petitioners’ equipment on the Covered List at an earlier time is irrelevant. Congress has “power to ratify the acts which it might have authorized” and such “ratification, if made, [is] equivalent to an original authority.” United States v. Heinszen, 206 U.S. 370, 384 (1907). Even if Petitioners were correct that the FCC misinterpreted the SNA when it first placed Petitioners’ products on the Covered List, Congress’s ratification of the Covered List has foreclosed that claim.6
Finally, to the extent that there is any ambiguity, the national-security judgments and concerns underlying the Executive Branch’s decision in this case counsel deference. See Dep’t of Navy v. Egan, 484 U.S. 518, 530 (1988) (“[C]ourts traditionally have been reluctant to intrude upon the authority of the Executive in military and national security affairs.”). As we have previously written, “[w]e cannot second-guess the FCC’s judgment that allowing China to access this information poses a threat to national security.” Pac. Networks Corp. v. FCC, 77 F.4th 1160, 1164 (D.C. Cir. 2023). That deference is redoubled by the repeated acts of Congress expressly identifying Petitioners’ video-surveillance equipment as posing national-security risks. See Fed. Express Corp. v. Dep’t of Commerce, 39 F.4th 756, 770 (D.C. Cir. 2022) (requiring the
6 We hold only that Congress ratified the content of the Covered List when it enacted the SEA. We therefore need not reach the question of whether Congress ratified the interpretations of the SNA that the FCC employed when creating that list. We also do not express any view on Petitioners’ arguments about the FCC’s authority under the SNA. 19 “full force” of judicial deference on issues that “fall in the core of Executive and Legislative Branch expertise in the areas of national security and foreign affairs”).
Under the challenged Order, Petitioners’ equipment is banned only when used “[f]or the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.” J.A. 209 (alteration in original). Petitioners take issue with the FCC’s newly introduced definition of “critical infrastructure” in the Order. See Pet’rs’ Br. 46 (“The Commission’s interpretation of ‘critical infrastructure’ eviscerates the statutory limits and contravenes Congressional intent by treating nearly all aspects of the economy as ‘critical infrastructure.’”). We agree with Petitioners that the Commission’s interpretation is unjustifiably broad and is therefore arbitrary and capricious. See 5 U.S.C. § 706(2)(A).
The FCC relied on the Patriot Act, Presidential Policy Directive 21, and the Cybersecurity and Infrastructure Security Agency’s set of National Critical Functions in crafting its definition of critical infrastructure. The Order states that “any systems or assets, physical or virtual, connected to the sixteen critical infrastructure sectors identified in PPD-21 or the 55 [National Critical Functions] identified in [the] CISA/NRMC [risk management guide] could reasonably be considered ‘critical infrastructure.’” J.A. 211. Although Petitioners concede that the FCC’s application of the Patriot Act definition of critical infrastructure may be appropriate, they assert that the Commission went too far in incorporating PPD-21 and the CISA National Critical Functions, as well as sweeping in anything that is merely “connected to” those economic sectors and functions. Pet’rs’ Br. 54–57 (arguing that the FCC 20 “wrongly conflated multiple definitions of ‘critical infrastructure’ from different sources, without considering how they fit together or apply here”).
The Commission’s choice of reference materials — government sources that define “critical infrastructure” and related concepts in national-security contexts — was reasonable, and the Commission adequately explained why the cited sources were relevant. See Motor Vehicle Mfrs. Ass’n of U.S., Inc. v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983) (noting that in determining whether an agency has provided a “satisfactory explanation,” courts look for “whether the decision was based on a consideration of the relevant factors and whether there has been a clear error of judgment” (quotation marks omitted)). The Patriot Act defines “critical infrastructure” as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.” 42 U.S.C. § 5195c(e). Meanwhile, PPD-21 identifies sixteen “critical infrastructure sectors,” including commercial facilities, dams, emergency services, and food and agriculture. Directive on Critical Infrastructure Security and Resilience, 1 Pub. Papers 106, 114–15 (Feb. 12, 2013). And the CISA National Critical Functions Set includes activities such as “provid[ing] cable access network services,” “distribut[ing] electricity,” “conduct[ing] elections,” “provid[ing] metals and materials,” and “supply[ing] water.” National Risk Management Center, Cybersecurity and Infrastructure Security Agency, National Critical Functions Status Update to the Critical Infrastructure Community 2–8 (2020) (capitalization altered throughout). The FCC’s reliance on its chosen sources reflects appropriate consideration of relevant factors identifying “critical” areas of the economy that 21 have been vetted by those in the Executive Branch charged with assessing national-security risks. See Republican Nat’l Comm. v. FEC, 76 F.3d 400, 408 (D.C. Cir. 1996) (“[T]he Commission’s new regulation results from exactly the kind of agency balancing of various policy considerations to which courts should generally defer.”); LaRose v. FCC, 494 F.2d 1145, 1146 n.2 (D.C. Cir. 1974) (noting that part of the FCC’s regulatory mandate is to “consider other federal policies”).
But the definition of “critical infrastructure” ultimately adopted by the FCC includes any “systems or assets” that are merely “connected to” the sixteen sectors identified by PPD-21 or the fifty-five functions listed by the CISA risk-management guide. J.A. 211. The FCC failed to explain or justify its use of the expansive words “connected to,” and the scope of the definition is therefore arbitrarily broad.
First, the Commission does not explain why everything “connected to” any sector or function that implicates national security must be considered “critical,” especially in light of the Patriot Act’s emphasis on particular “systems and assets” that are “vital to the United States.” The FCC’s definition threatens to envelop ever-broadening sectors of the economy. As Petitioners note, the FCC’s definition reads the word “critical” out of the statute and applies the equipment-authorization ban to all “infrastructure.” Pet’rs’ Br. 56. It is entirely implausible that every single system or asset that is “connected to,” for example, the food and agriculture sector, or to the function of supplying water, is “critical” to the national security of the United States. The FCC did not rebut Petitioners’ argument that “coffee shops, residential apartment buildings, used car lots, and dry-cleaning stores” could all plausibly fall within the Commission’s definition. Id. at 57. Indeed, at oral argument, the FCC was unable to identify any relevant infrastructure that would not be covered, whether critical or not. Oral Argument 22 at 52:28–53:50. Without further explanation of why its expansive interpretation is reasonable or consistent with the statute, the Commission’s definition is not in accordance with law and is arbitrary and capricious. See 5 U.S.C. § 706(2)(A); China Telecom, 57 F.4th at 264 (agencies must “reasonably explain[]” their decisions (quotation marks omitted)).
Second, the FCC’s definition fails to provide comprehensible guidance about what falls within the bounds of “critical infrastructure.” Instead, the Order merely states that “any” systems or assets “connected to” a laundry list of economic sectors and functions “could reasonably be considered” critical infrastructure. J.A. 211. Although the FCC suggests that “[P]etitioners need only seek guidance from the Commission by submitting a request for a declaratory ruling,” such a requirement is unworkable. Resp. Br. 57. The Commission has essentially frozen all sales of Petitioners’ equipment in the United States until Petitioners can submit a marketing plan which demonstrates that their products will not be used for “physical security surveillance of critical infrastructure.” J.A. 209. Without a clear understanding of what constitutes a “connect[ion] to” critical infrastructure, Petitioners will face significant difficulty in developing such a marketing plan. The FCC provides no justification for imposing such a burden on Petitioners. See ACA Int’l v. FCC, 885 F.3d 687, 700 (D.C. Cir. 2018) (Agency action is “arbitrary and capricious” if it “fails to articulate a comprehensible standard” and “offers no meaningful guidance to affected parties.” (quotation marks omitted)).
Accordingly, we conclude that the FCC’s definition of “critical infrastructure” as all systems and assets “connected to” sixteen economic sectors and fifty-five economic functions is overbroad, unexplained, and arbitrary. 23 * * *
For the foregoing reasons, we uphold the FCC’s Order to the extent that it prohibits the authorization of Petitioners’ equipment for sale and marketing in the United States for use in the physical security surveillance of critical infrastructure; but we vacate the portions of the FCC’s order defining “critical infrastructure” and remand to the Commission to comport its definition and justification for it with the statutory text of the NDAA. Ky. Mun. Energy Agency v. FERC, 45 F.4th 162, 179– 80 (D.C. Cir. 2022) (“Vacatur is the normal remedy for unsustainable agency action, and . . . the Commission . . . [has not] given us any reason to depart from that standard course of action.” (cleaned up)).
So ordered.