Spokane Airport Board v. TSA

• Court: Court of Appeals for the D.C. Circuit
• Decided: January 20, 2026
• Docket: 23-1155
• Status: Published

Opinion

United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT

Argued April 11, 2025 Decided January 20, 2026

No. 23-1155

SPOKANE AIRPORT BOARD, PETITIONER

v.

TRANSPORTATION SECURITY ADMINISTRATION, RESPONDENT

On Petition for Review of a Final Order of the Transportation Security Administration

James A. McPhee argued the cause for petitioner. With him on the briefs were Brian M. Werst and Jon T. Burtard.

Ben Lewis, Attorney, U.S. Department of Justice, argued the cause for respondent. With him on the brief were Brett A. Shumate, Acting Assistant Attorney General, U.S. Department of Justice, and Sharon Swingle, Attorney, U.S. Department of Justice.

Before: SRINIVASAN, Chief Judge, RAO and PAN, Circuit Judges.

Opinion for the Court filed by Circuit Judge RAO. 2 RAO, Circuit Judge: Facing increased cybersecurity threats to the aviation sector, the Transportation Security Administration (“TSA”) issued an emergency amendment requiring airport security programs to include certain cybersecurity measures and controls. Spokane Airport Board (“Spokane”) petitions for review, arguing that TSA’s amendment was without statutory authority, inconsistent with regulatory requirements, and arbitrary and capricious. Several of Spokane’s arguments were not raised below, so we cannot consider them, and the remaining arguments fail on the merits. We therefore deny Spokane’s petition.

I.

A.

Following the terrorist attacks of September 11, 2001, Congress established TSA and vested it with responsibility for “civil aviation security.” Aviation & Transportation Security Act, Pub. L. No. 107-71, § 101(a), 115 Stat. 597, 597 (2001). TSA is required to “assess threats to transportation” and to “develop policies, strategies, and plans for dealing with threats to transportation security.” 49 U.S.C. § 114(f)(2)–(3).

As relevant to this case, TSA is specifically required to “oversee the implementation, and ensure the adequacy, of security measures at airports.” Id. § 114(f)(11). By regulation, airports must adopt and implement “airport security programs” to provide for “the safety and security of persons and property on an aircraft operating in air transportation.” 49 C.F.R. § 1542.101(a)(1). Once an airport security program has been approved by TSA, it may be amended upon approval of an airport operator’s request or by TSA through notice and comment procedures. Id. § 1542.105(b)–(c). 3 If, however, TSA finds that “an emergency requiring immediate action with respect to safety and security in air transportation” makes the ordinary procedural requirements “contrary to the public interest,” TSA may issue an amendment to airport security programs without providing opportunity for public comment. Id. § 1542.105(d). For an emergency amendment, TSA must issue a notice that includes a “brief statement of the reasons and findings” justifying the amendment. Id. An emergency amendment is immediately effective and is not stayed by the filing of a petition for reconsideration. Id.

B.

In recent years, the federal government has become concerned about the aviation sector’s vulnerability to cyberattacks. For instance, cybercriminals have repeatedly launched ransomware attacks that disrupt aviation supply chains; a foreign state affiliated actor conducted a cyberespionage campaign against multiple U.S. airports, airlines, and aviation support organizations; and a set of pro- Russia hacktivist groups launched cyberattacks against airport websites. Still other unidentified cyber actors have targeted individual airports and airlines. 1

In August 2022, TSA responded to this emergent threat by proposing an amendment to the security programs of certain large airports. See Proposed Requirement to Amend TSA- Approved Airport Security Program, TSA-PNA-22-03 (Aug. 11, 2022). The proposed amendment would have required covered airports to implement cybersecurity measures to

1 The government cites classified materials for additional evidence of cybersecurity threats to aviation. We have reviewed this material, but rely only on materials from the public record in this opinion. 4 protect against foreign adversaries and other malicious actors. The proposed amendment received hundreds of comments from industry participants and other interested parties. Seeking “further discussion,” TSA rescinded the proposed amendment in November 2022 and held “additional industry engagement calls.” J.A. 73.

A few months later, TSA promulgated an emergency amendment that substantially incorporated the previously proposed amendment. See Joint Emergency Amendment to TSA-Approved Security Program, 23-01 (Mar. 7, 2023) (the “Amendment”) (relying in relevant part on emergency authority in 49 C.F.R. § 1542.105(d)). The Amendment requires certain airport and aircraft operators to add cybersecurity measures and controls to their security programs. Airport operators must identify a list of critical systems within 30 days of the Amendment’s effective date, submit to TSA a Cybersecurity Implementation Plan containing a set of cybersecurity measures and controls for those systems within 90 days of the effective date, and annually assess the effectiveness of their cybersecurity plans. TSA issued the Amendment without notice and comment because it determined that “there is an emergency requiring immediate action” to protect “national and transportation security” from the impact of cybersecurity threats.

Spokane Airport Board, which operates Spokane International Airport in eastern Washington, petitioned TSA for reconsideration. Spokane raised several procedural and substantive objections to the Amendment. TSA rejected the reconsideration petitions of Spokane and other objectors. Spokane filed a timely petition for review. See 49 U.S.C. § 46110(a). 5 II.

We have authority to “affirm, amend, modify, or set aside any part of” a TSA order. 49 U.S.C. § 46110(c). Section 46110 is silent as to the standard of review, and so we apply the standards set forth in the Administrative Procedure Act. Cf. Carus Chem. Co. v. EPA, 395 F.3d 434, 441 (D.C. Cir. 2005). TSA’s decision will be upheld “unless it is ‘arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.’” Ramsingh v. TSA, 40 F.4th 625, 631 (D.C. Cir. 2022) (quoting 5 U.S.C. § 706(2)(A)).

An objection to TSA’s order may be considered “only if the objection was made in the proceeding” below or there was a “reasonable ground” for failing to raise it. 49 U.S.C. § 46110(d). We have held that an objection not raised or excused is “jurisdictionally barred.” 2 City of Olmsted Falls v. FAA, 292 F.3d 261, 274 (D.C. Cir. 2002); see also Wallaesa v. FAA, 824 F.3d 1071, 1077 n.4 (D.C. Cir. 2016) (holding that section 46110(d)’s bar applies even when not invoked by the government).

III.

Spokane argues the Amendment should be set aside because: (1) TSA lacks statutory authority to regulate cybersecurity; (2) the Amendment is inconsistent with TSA

2 The Supreme Court has indicated that most exhaustion requirements are “claim-processing rule[s]” and “ordinarily … not jurisdictional.” Santos-Zacaria v. Garland, 143 S. Ct. 1103, 1112 (2023) (cleaned up); see also EPA v. EME Homer City Generation, LP, 572 U.S. 489, 511–12 (2014) (holding the Clean Air Act’s exhaustion requirement is not jurisdictional). But this court has squarely held that section 46110(d) is jurisdictional, and we follow this controlling precedent. 6 regulations; (3) the Amendment was required to be, but never was, ratified by the Transportation Security Oversight Board; and (4) the Amendment was arbitrary and capricious. We hold that these arguments either were not properly raised before TSA or fail on the merits.

We begin with Spokane’s argument that the Amendment exceeds TSA’s statutory authority because the agency is not explicitly empowered to regulate cybersecurity and other statutes address cybersecurity without granting regulatory authority to TSA.

TSA has statutory authority to regulate cybersecurity. Congress has conferred on TSA “broad statutory authority to protect civil aviation security.” Bonacci v. TSA, 909 F.3d 1155, 1157 (D.C. Cir. 2018); see 49 U.S.C. § 114(d)(1). TSA must “assess threats to transportation” and “develop policies, strategies, and plans for dealing with threats to transportation security.” 49 U.S.C. § 114(f)(2)–(3). Spokane does not dispute that cyberattacks increasingly pose a threat to transportation security, especially in the aviation sector. And TSA’s regulatory mandate allows it to assess and address such “risks to aviation and national security.” Olivares v. TSA, 819 F.3d 454, 466 (D.C. Cir. 2016). Further, as Spokane acknowledges, Congress has evinced a specific concern for the impact of cyberattacks on aviation, explicitly instructing TSA to “periodically review threats to civil aviation” including the “disruption of civil aviation service” caused by “cyber attack.” 3

3 Spokane also argues that other statutes referencing cybersecurity foreclose TSA’s authority, but none of these statutes specifically implicate aviation security. See Federal Information Security Management Act of 2002, Pub. L. No. 107-347, Tit. III, §§ 301–05, 116 Stat. 2899, 2946–61; Federal Information Security 7 49 U.S.C. § 44912(b)(1)(A)(ii). These overlapping statutory authorities clearly demonstrate that TSA’s regulatory mandate to protect aviation security encompasses cyberattacks.

Spokane next argues the Amendment is inconsistent with TSA regulations because cybersecurity plans are not listed as one of the required elements for an airport security program in 49 C.F.R. § 1542.103.

Spokane’s argument fails because the regulatory requirements for an airport security program are not exclusive. Rather, an airport security program must “[i]nclude[] the applicable items listed in § 1542.103.” 49 C.F.R. § 1542.101(a)(3). If there were any doubt, the term “includes” is defined in the same chapter to mean “includes but is not limited to.” Id. § 1500.5(b)(3). By the plain meaning of the regulation, an airport security program may be required to include more than the items detailed in section 1542.103. Moreover, TSA has the authority to amend the content of an airport security program when safety and the public interest so require. Id. § 1542.105(c)–(d). The Amendment adds cybersecurity plans to airport security programs, which is squarely within TSA’s regulatory authority.

Modernization Act of 2014, Pub. L. No. 113-283, 128 Stat. 3073; Cybersecurity Act of 2015, Pub. L. No. 114-113, Div. N, §§ 101– 407, 129 Stat. 2242, 2935–85; Cybersecurity & Infrastructure Security Agency Act of 2018, Pub. L. No. 115-278, 132 Stat. 4168; Cyber Incident Reporting for Critical Infrastructure Act of 2022, Pub. L. No. 117-103, Div. Y, §§ 101–07, 136 Stat. 49, 1038–59. These statutes reference cybersecurity but say nothing about TSA’s authority to regulate aviation security and to protect against cybersecurity threats. 8 Spokane also argues the Amendment is inconsistent with TSA regulations because it does not relate to “criminal violence” or “aircraft piracy” and does not directly amend the content of airport security programs. See 49 C.F.R. §§ 1542.101(a)(1) & 1542.105. These objections were not raised by Spokane before TSA. 4 Nor is there any evidence in the record that similar objections were made by a different participant. See Muir v. U.S. Dep’t of Homeland Sec. & TSA, 145 F.4th 1359, 1367 (D.C. Cir. 2025) (holding courts may consider an objection if the petitioner shows “where another party raised” it below). We cannot consider Spokane’s objections because they were not raised in the proceeding below. 49 U.S.C. § 46110(d).

C.

Spokane next argues the Amendment exceeds TSA’s emergency rulemaking authority because it was not ratified by the Transportation Security Oversight Board. Spokane emphasizes that TSA issued the amendment without notice and comment and maintains that TSA could have done so only under its emergency rulemaking authority in 49 U.S.C. § 114(l)(2), which requires Board ratification of emergency rules within 90 days of promulgation.

Spokane did not raise this objection before TSA, nor was it raised by any other participant. We therefore cannot consider it. 49 U.S.C. § 46110(d). During oral argument, counsel for Spokane argued that a reference in the reconsideration petition to the applicable TSA regulations was sufficient to preserve an objection regarding the “guaranteed statutory procedure.”

4 In reply, Spokane claims it preserved the direct amendment argument, but it cites only to a part of the reconsideration petition that presented entirely different arguments. 9 Merely gesturing at a particular regulation, however, is not enough. To preserve an objection for judicial review under section 46110(d), a participant must provide sufficient specificity to put the agency on notice of the objection.

Moreover, the facts here demonstrate the importance of exhaustion requirements for orderly administrative and judicial proceedings. Had Spokane argued that Board ratification was required, TSA could have sought ratification at the Board’s April 20, 2023, meeting—which occurred after Spokane’s petition for reconsideration was filed but before it was denied by TSA.

D.

Finally, Spokane argues that TSA’s issuance of the Amendment was arbitrary and capricious. Agency action must be “reasonable and reasonably explained.” FCC v. Prometheus Radio Project, 141 S. Ct. 1150, 1158 (2021). An agency action is arbitrary and capricious if the agency “entirely failed to consider an important aspect of the problem” or “offered an explanation for its decision that runs counter to the evidence before the agency.” Motor Vehicle Mfrs. Ass’n of the U.S., Inc. v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983).

Spokane raises several arguments for why the Amendment was arbitrary and capricious. First, Spokane objects to TSA’s requirement that airport operators submit documentation using password-protected emails. Second, Spokane argues the Amendment irrationally allows TSA to designate systems as “critical” even if they have nothing to do with cybersecurity. Third, Spokane claims that TSA’s aggregation of cybersecurity information from many airports creates a target for malicious actors. Fourth, Spokane asserts that compliance with the Amendment is too costly and requires more time. Finally, Spokane argues that, because airport security programs must 10 now include cybersecurity plans, the Amendment deprives airport operators of the flexibility to make improvements to those plans without TSA approval.

Spokane has failed to demonstrate the Amendment was arbitrary and capricious. As a general matter, TSA detailed the present cybersecurity threats to aviation and the cost of cyberattacks to affected entities. In light of these concerns, TSA reasonably chose to require substantial and rapid improvements in airport cybersecurity through an emergency amendment. With regard to Spokane’s more specific concerns, TSA explained that the option of email submission was supported by its internal data experts and complied with federal law, and that, in any event, TSA no longer requires email submission of airport cybersecurity plans. TSA also explained that its authority to designate systems as critical—even when not so identified by airport operators—is necessary to prevent gaps in airport cybersecurity. As for data security, TSA explained it has implemented various measures and controls to secure agency data and information collected from regulated entities.

Finally, the Amendment does not unreasonably interfere with the ability of airport operators to make improvements to their cybersecurity plans. By mandating that airport security programs include cybersecurity plans, the Amendment requires operators to obtain TSA approval for changes to those plans. See 49 C.F.R. § 1542.105(b). Spokane characterizes this loss of flexibility as unreasonable. But given the threats to aviation, TSA reasonably concluded that large airports like Spokane must address cybersecurity in their security programs—even if that decision reduces flexibility for some operators. Moreover, the loss of flexibility is not as great as Spokane claims, since airport operators need not secure TSA approval for improvements that do not conflict with their existing security 11 programs. TSA also indicated that, to the extent the process for securing TSA approval impedes necessary cybersecurity improvements, it would consider changes to the amendment process in the future.

Congress has conferred substantial authority upon TSA to regulate aviation security, and we decline to disturb the agency’s reasonable judgments about how to best carry out its statutory mandate. Cf. Bonacci, 909 F.3d at 1161–62.

***

TSA’s broad authority over civil aviation security enables it to address cybersecurity threats to U.S. airports. Spokane failed to exhaust several of its objections before TSA, and the remaining arguments we reject on the merits. The petition for review is denied.

So ordered.