Kaspersky Lab, Inc. v. U.S. Dep't of Homeland Sec.
311 F. Supp. 3d 187
D.C. Cir.2018Background
- Kaspersky Lab (a multinational headquartered in Russia) sold antivirus products used by some U.S. federal agencies; concerns arose in 2017 about potential Russian government access or influence over those products.
- DHS issued Binding Operational Directive 17-01 (BOD 17-01) ordering federal agencies to identify and remove Kaspersky-branded products from federal systems; DHS conducted an administrative record and gave Kaspersky an opportunity to respond.
- Congress enacted the NDAA FY2018, §1634, which bars all federal agencies from using products, hardware, software, or services developed or provided by Kaspersky Lab, effective October 1, 2018.
- Kaspersky filed two suits: (1) the BOD Lawsuit challenging DHS’s BOD under the APA and Fifth Amendment (procedural/due process), and (2) the NDAA Lawsuit challenging §1634 of the NDAA as an unconstitutional bill of attainder.
- The court considered overlapping briefing: it dismissed the NDAA Lawsuit for failure to state a bill-of-attainder claim, and dismissed the BOD Lawsuit for lack of Article III standing because the NDAA independently foreclosed any redress.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether §1634(a)-(b) of the NDAA is a bill of attainder | NDAA singled out Kaspersky and deprived it of government business and reputation, amounting to legislative punishment | The statute serves a nonpunitive national-security purpose and does not inflict historical forms of legislative punishment | Dismissed: NDAA is not a bill of attainder (no punishment) |
| Whether the NDAA satisfies the specificity element of a bill of attainder | Specificity established because Kaspersky is named/targeted | Specificity conceded or assumed by gov't; dispute is over punishment | Court assumed specificity satisfied but ruled failure on punishment element |
| Whether the NDAA imposes "punishment" (Historical, Functional, Motivational tests) | Plaintiffs: effects akin to employment bans and reputational branding; burden disproportional | Government: measures are prophylactic, rationally related to protecting federal systems; no evidence of punitive intent | Dismissed: fails Historical, Functional, and Motivational tests; statute furthers legitimate nonpunitive ends |
| Standing to challenge BOD 17-01 when NDAA remains in force | BOD injured Kaspersky by barring sales and harming reputation; rescission would redress harms | Even if BOD were rescinded, NDAA remains and would continue to bar use and harm reputation, so no redressability | Dismissed: Plaintiffs lack Article III standing because rescission of BOD would not redress injuries |
Key Cases Cited
- Nixon v. Administrator of General Services, 433 U.S. 425 (1977) (defines bill of attainder and the historical/functional/motivational framework for punishment analysis)
- Selective Service Sys. v. Minn. Pub. Interest Research Group, 468 U.S. 841 (1984) (articulates the three-part inquiry for legislative punishment)
- Foretich v. United States, 351 F.3d 1198 (D.C. Cir. 2003) (discusses specificity and punishment analyses in bill-of-attainder context)
- BellSouth Corp. v. F.C.C., 162 F.3d 678 (D.C. Cir. 1998) (analyzes differences between employment bans and regulatory/business restrictions for bill-of-attainder claims)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (standing: injury-in-fact, causation, redressability requirements)
- Bennett v. Spear, 520 U.S. 154 (1997) (clarifies redressability and causation in administrative-law standing)
- Ashcroft v. Iqbal, 556 U.S. 662 (2009) (pleading standard: plausibility requirement)
- Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007) (pleading standard for plausible claims)