A Dog Shirt In the Wild

And a week’s catch-up

Good Morning:

I was sitting the other day in The Line, a D.C. hotel with a lovely co-working space at which I often work, watching the manager inform a young woman that she couldn’t bring outside food into that co-working space—and would have to either get rid of her coffee and muffin or take them elsewhere. She was annoyed, having found a nice table not aware of the rule, and after briefly asking him whether there any work-around, she stood up to gather her stuff and leave. It was then that I saw it: She was wearing a dog shirt.

I pointed out to her that I, too, was wearing a dog shirt. She was mildly amused.

I then pointed out to her that I always wore dog shirts. She was mildly intrigued and asked me whether that was for realz.

Indeed, I told her. In fact, I have a daily livestream called #DogShirtTV and a Substack called #DogShirtDaily. And, in fact, would it be okay if I snapped a picture of her for the Substack?

I imagine she thought I was either a total creep or a crazy person, but she was also amused. But she graciously posed for the picture above. And having been, in the space of two minutes, accosted by a manager who was throwing her out of The Line and a crazy person in a dog shirt with a Substack, she gathered her stuff and left to eat her muffin and drink her coffee in peace.

And that, my friends, is the story of today’s Good Morning image.

THANK YOU FOR YOUR ATTENTION TO THIS MATTER!

---

Monday on #DogShirtTV, the estimable Holly Berkley Fletcher and I had a rambling discussion about Holocaust movies that somehow turned into a rambling discussion of the nature of repentance:

Tuesday on #DogShirtTV, the estimable Alicia Wanless, the estimable Holly Berkley Fletcher, and I discussed the weirdness of trying to describe Trump’s behavior:

Wednesday on #DogShirtTV, the estimable Mike Feinberg and I brought on the estimable Roger Parloff to talk about the prosecution of Jim Comey:

Thursday on #DogShirtTV, the estimable Mike Feinberg reviewed a review:

Friday on #DogShirtTV, the estimable Anastasiia Lapatina came on to give us an update on her life, and I reviewed Mike Feinberg’s review of a review:

---

Recently On Lawfare

Compiled by the estimable Sarah Willrich

The Rip Van Winkle Court

Peter Beck and Seamus Hughes analyze recent filings before the Alien Terrorist Removal Court (ATRC), which, until last week, did not have a case since its founding in 1996. Beck and Hughes break down the procedures that the ATRC uses to process cases where evidence is classified, why the Justice Department has previously favored other forms of enforcement for noncitizens with potential terrorist affiliations, and the magnitude of case required to change that.

News of the court’s inaugural case, which Court Watch reported first, spread quickly. For some, the ATRC’s sudden awakening stirred fears that the court may be used to undermine civil liberties to help carry out the Trump administration’s aggressive immigration agenda. For others, the first case signaled a significant development in national security law—and that prosecutors believed a matter was critical enough to do what their predecessors had repeatedly opted against in invoking the ATRC’s authority for the first time.

What They Want to Hear: The Politicization of U.S. Intelligence

Julia Curlee unpacks how intelligence gets politicized in practice and how the Trump administration is taking the process even further. She explains that politicization is prevented through a combination of norms of objectivity and structural protections for officers when they uphold those norms. Curlee argues that both are undermined by the administration’s tactics of retaliatory firings, rescinding of security clearances, and selective declassifications.

None of this should depend on courage alone. When people think of “speaking truth to power,” they imagine the lone analyst staring down a Cabinet secretary, but candor at that level is a structural achievement. Analysts deliver unwelcome judgments because the standards require them to, the ombudsman protects them, and their careers do not hang in the balance. Strip those protections, and you don’t merely test their bravery—you undermine confidence in the analysis on which sound decisions depend.

Tokyo’s Nuclear Dilemma

In the latest edition of Lawfare’s Foreign Policy Essay series, Evan Braden Montgomery and Toshi Yoshihara consider recent signals that Japan is reconsidering its reluctance to build nuclear weapons. Montgomery and Yoshihara argue such a move could paradoxically increase vulnerability by encouraging reprisal by China, undermining the security gains from deterrence, and requiring the U.S. to take on greater risk on its ally’s behalf instead of enabling Japan’s security independence.

Consider, for instance, how the rivalry between Japan and China could evolve in response to a nuclear push by Tokyo. Beijing has long been highly sensitive to any developments that could undermine its deterrent posture. A Japanese nuclear breakout, however, would represent an entirely different—and far more acute—level of danger. Beijing’s supercharged threat perceptions about Tokyo would magnify its fears of a hostile proliferator next door. Many on the mainland hold deep suspicions about Japan’s commitment to nonproliferation and believe that it maintains a latent nuclear weapons capability. Such profound distrust of Tokyo likely reinforces Beijing’s unwillingness to accept mutual vulnerability vis-a-vis Japan.

Powering Data Centers and the Permitting Problem

James W. Coleman discusses the Justice Department’s intervention in the NAACP lawsuit against xAI’s data center. He suggests that the Trump administration’s effort to block the lawsuit is a novel approach to the longstanding difficulty past administrations have faced when trying to develop critical infrastructure. Coleman argues that supporting data centers will ultimately require robust electric grid development that goes beyond one lawsuit.

Presidential administrations are finding new and innovative ways to exercise discretion to shape industry investment. But the crucial asymmetry is that, because projects need dozens of approvals to go forward, it is far easier for a president to stop disfavored infrastructure investments than it is for the president to see an infrastructure investment through to completion. President Obama was able to prevent the Keystone XL pipeline from being built but failed to build high-speed rail. This is what I have called the “jurisdictional anticommons”—the idea that when development is subject to the whim of too many actors, of courts and policymakers in multiple jurisdictions, infrastructure may be underprovided. Any single court or policymaker can stop a project; keeping it moving requires every one of them to agree.

The Subpoena Detective: A Dispatch from the Times Hearing

Anna Bower reports from the U.S. District Court for the Southern District of New York, where Judge Arun Subramanian held a hearing on The New York Times’s motion to quash subpoenas issued to several of its reporters by the Department of Justice in response to their coverage of the new Air Force One.

With introductions behind him, Judge Subramanian wastes no more time on pleasantries. He announces that he has a few questions for both sides before turning things over to argument. But it becomes clear almost immediately that “a few questions” is something of an understatement, while “both sides” is a bit of an overstatement. The judge has a legal pad’s worth of questions for the government, and he intends to get an answer to every single one.

The AI Sovereignty Paradox

Masahiro Kurosaki argues that two pressures are pushing customary international law toward treating any unauthorized access to a state’s artificial intelligence (AI) infrastructure as a sovereignty violation: AI assets’ new status as national security priorities, and the fact that exfiltration and data poisoning don’t fit existing harm-based thresholds. Kurosaki explains that this leaves the U.S. and other states that have kept those thresholds high—to preserve latitude for their own cyber operations—with no clear legal basis to protect their own AI infrastructure.

Each camp now faces a version of the same question: Where should the protection-latitude balance be redrawn? For the pure sovereignty camp, AI sovereignty validates the position it already holds. For the effects-based camp, it exposes the unprotected zone the Tallinn threshold leaves—particularly for data operations—and may require extending protection downward. For the operational latitude camp, it creates a structural trap: The legal positions designed to preserve space for intelligence operations are the same positions that deny legal remedies when AI infrastructure is the target. For U.S. policymakers specifically, if adversaries exfiltrate training data or model weights underpinning U.S. defense AI systems—including under AUKUS Pillar II or Pax Silica—the U.S. faces the same gap: no clear basis for calling the intrusion unlawful and therefore none for the countermeasures that would follow from it.

The AI That Hacked Its Way Out and the Hype That Followed It

Kate Klonick argues that the narratives responding to the hacking of Hugging Face by a rogue OpenAI agent are steering regulators toward the wrong conclusions. Klonick outlines reactions by artificial intelligence (AI) analysts, regulators, and OpenAI’s own press releases, all of which emphasized the agents’ capabilities, suggesting that they obscure the root causes of the issue and result in policy that fails to effectively address vulnerabilities.

Read OpenAI’s disclosure carefully and notice what kind of failure it describes. Not negligence. Not a misconfigured sandbox. The company’s framing is that its models are so capable, so relentlessly agentic, that they clawed their way out of containment in pursuit of a goal. The apology doubles as an advertisement: Our system is so advanced it hacked a real company by accident. Even the remediation is a sales funnel—the victim is onboarded into OpenAI’s trusted access program, now a customer for the defensive capabilities of the same models that attacked it. Neither OpenAI nor Hugging Face, it’s worth noting, called for regulation in response, but the breach was always going to lead to increased regulatory scrutiny. Framed in this way, however, the breach also becomes a product demo.

Sued by the State, Judged by the State

Christopher Nye argues that a new Chinese draft legislation would allow foreign individuals and organizations to be sued for acts that harm a nebulously defined Chinese national interest. Nye encourages the U.S. to adopt a defensive approach that protects U.S. companies instead of creating a symmetric legal capability.

Article 51 has no list at all—any “illegal act” that “harms” China’s national or public interests qualifies. The asymmetry is the point. A Chinese defendant can be sued by a prosecutor only for conduct the legislature took care to enumerate. A foreign defendant faces an open-ended standard whose every operative term—the illegality, the harm, and the interest—the state defines for itself. The draft’s other safety valves are keyed to the domestic list, not to the foreign clause. The screen against docketing a civil case when an administrative fix would do attaches to Article 3’s categories.The 30-day notice that gives nongovernmental organizations and designated agencies first crack applies only where some other body holds a statutory right to sue. For an “illegal act harming national interests” by a foreigner, no nongovernmental organization holds one. On the text, the foreign defendant gets the broadest exposure and the fewest filters.

Inferior Officers Protections Post-Slaughter

Peyton Baker, Nick Bednar, and Amy Wildermuth analyze U.S. District Judge Michael Nachmanoff decision in Comans v. Executive Office of the President, which represents the first major test of how the Supreme Court’s decision in Trump v. Slaughter affects the removal of inferior officers. The trio discuss the court’s affirmation that inferior officers are protected, where to draw the line between inferior and principal officers, and whether inferior officers are obligated to exhaust their options elsewhere before bringing their removal to court.

Although the question is close, Comans was likely an inferior officer. Under Perkins, she may be removed from her position only as provided in the governing statute, the CSRA. If Perkins falls, however, courts should expect to perform precisely this sort of analysis. Officer status will not track seniority, head count, or budget authority. Comans had all three, and the question was still close. It will instead turn on whether a statute or regulation routes decision-making authority to the official. This result is odd for civil service law. It is entirely possible that two officials of identical rank and even the same title may fall on opposite sides of the line because their agencies grant the officials different authority.

Designing a FINRA for Frontier AI

Mark Thomas considers what a self-regulatory organization (SRO) could and should look like for the artificial intelligence (AI) industry. Thomas argues that the SRO’s structure, from its membership to its rulemaking authority, should be designed to create a body that works efficiently, has subject expertise, and incentivizes its members to regulate themselves.

A key SRO advantage is that industry can write rules faster and more expertly than a government agency, leveraging insider knowledge. But the SRO must be incentivized to use that advantage. Without pressure, its optimal strategy is to write one set of rules satisfying statutory requirements and then stop. The best incentive is the credible threat that if the SRO does not act, the supervisor will—and industry would rather draft the rules itself.

Anthropic v. U.S. Department of War: A Hearing Diary

Roger Parloff live-blogs a hearing from the U.S. District Court of the Northern District of California, where Anthropic argued its motion for summary judgment in its suit challenging the Department of Defense’s designation of the company as a supply chain risk.

Last March, Judge Lin granted a preliminary injunction in favor of Anthropic. The parties agree that the case is now ready for final decision on the merits on the basis of the written record. (Anthropic has a similar suit pending against the Defense Department in the U.S. Court of Appeals for the D.C. Circuit to challenge a supply-chain risk designation Secretary Pete Hegseth made at about the same time under a different statute: 41 U.S.C. § 4713.)

Lawfare’s Roger Parloff live-posted the hearing as it happened, by following on a Zoom feed. Read his account by clicking the button below or by viewing his thread on X here.

War, Race, and America’s Values

Gregory A. Daddis reviews Wil Haygood’s book, “The War Within a War: The Black Struggle in Vietnam and at Home.” Daddis praises how Haygood elevates the personal experiences of individual Black service members while connecting those stories to the broader history of the Jim Crow South and the Civil Rights Era. The book’s insights, Daddis argues, remain relevant in the current moment of politicization at the Department of Defense.

Contradictions abound in these personal stories, presenting difficult questions, if not challenges, to the men and women who served in Vietnam, if not to 1960s American society writ large. Was the “dap” handshake—a stylized greeting popular among African American soldiers involving palm slaps and fist bumps—a sign of cultural esprit de corps or an affront to military order and discipline? Was fighting communism abroad more important than resolving racial inequities at home? Perhaps most frightening of all, were young Blacks conscripted into the armed forces and trained to kill the enemy a potential threat to society once they returned home from Vietnam? Haygood carefully avoids a moralistic tone while exploring these weighty questions, instead elevating the individuals he follows by accentuating their voices across an expansive narrative.

How Trump v. Slaughter Strengthens the Case for Third-Party AI Regulation

Daniel Wilf-Townsend argues that the Supreme Court’s decision in Trump v. Slaughter makes third-party regulation a more favorable option for artificial intelligence (AI) governance compared to a traditional regulatory agency. Wilf-Townsend explains that, because Slaughter allows the president to freely remove heads of independent agencies, any governmental AI regulatory body would always be vulnerable to political interference of the kind recently exhibited by the executive branch.

That is why Slaughter should be understood as arriving at a critical moment. The independent agency has at times been a leading institutional answer to exactly this problem. In the AI context, for instance, the bipartisan Blumenthal-Hawley framework proposed a licensing regime run by an “independent oversight body,” an idea industry leaders repeatedly endorsed before Congress in 2023. So this year has delivered a double whammy: The risks of direct political control of AI regulation have never been clearer, and one of the historical tools for mitigating those risks is now off the table. To be sure, agency independence was never perfect: If you want electoral accountability, you have to have elected officials oversee agencies in some way, which will always entangle politics and policy. But Slaughter eliminates an important way of fine-tuning the design of our policymaking institutions.

Chipping Away at Chinese AI Risks

In the latest edition of the Seriously Risky Business cybersecurity newsletter, Tom Uren discusses Congress’s proposed Collaboration on Adversarial Threats and Security Risks Act to respond to China’s AI development, the cyberattack on Minnesota cyber utilities attributed to an Iran-affiliated group, and more.

But right now there is an opportunity for the U.S. government to engage the Chinese government to encourage and shape this regulation to its advantage.

So as an overall strategy, what we’ve laid out above makes sense: Laws that free up frontier labs to combat distillation collectively; tightening chip controls to make sure the U.S. stays ahead of China; and engaging with Chinese regulators to prevent the spread of top-tier hacking capabilities to all and sundry.

Podcasts

On Monday’s Lawfare Daily, Eric Columbus, Anna Bower, and Roger Parloff discuss a hearing over the subpoenas sent to reporters with the New York Times, a hearing in the criminal case against Nicolás Maduro, the court-appointed U.S. attorney in the Western District of Washington suing over his termination, and the first convening of the ATRC.

On Tuesday’s Lawfare Daily, Natalie Orpett speaks with Fionnuala Ní Aoláin about her work on the United Nations Independent International Commission of Inquiry on Syria. They talk about investigating atrocities that occurred after the fall of the Assad regime, how to think about Syria’s new government and the international community’s response to it, and what it all says about global counterterrorism strategies.

On Tuesday’s Scaling Laws, Kent Walker joins Kevin Frazier to talk about Google’s proposal for an organization to regulate frontier AI. They discuss how such an organization would operate, what relationship it would have with the federal government, and its relevance to the recent Hugging Face hacking.

On Wednesday’s Lawfare Daily, Tyler McBrien presents a series of edited conversations from the 2026 Aspen Security Forum, where he sat down with Mark Goldberg, Kori Schake, Alex Zerden, and Alexandra Bell. They discuss the U.S.-Iran war, what’s left of bipartisanship in the Trump era, who from the current administration did—and didn’t—come to Aspen this year, what urgent foreign policy issues were missing from the agenda, and much more.

On Thursday’s Lawfare Daily, Jonathan Cedarbaum sits down with the Soufan Center’s Colin Clarke and Chad Serena to discuss the center’s recent report, “Closing the Gap: Software Understanding and U.S. National Security.” They explore what Clarke and Serena call the “software understanding gap,” how adversarial state actors and criminal groups can exploit this gap, how it poses a national security challenge, and what public and private actors can do to mitigate risks and strengthen U.S. cybersecurity.

On Lawfare No Bull, Sarah Willrich shares edited audio of the July 15 and 16 confirmation hearing before the Senate Judiciary Committee for Todd Blanche, President Trump’s nominee for attorney general.

On Rational Security, Scott Anderson sits down with me, Tyler McBrien, Anastasiia Lapatina, and Frazier to talk through a couple of the week’s big national security news stories, including Ukrainian President Volodymyr Zelensky’s meeting with President Trump and the hacking of Hugging Face by rogue OpenAI agents.

On Friday’s Scaling Laws, Laura Davis joins Frazier to dive into how her company, USLege, is leveraging AI to transform the way professionals monitor and respond to government activity.

Videos

On Lawfare Live, I sit down with Peter Harrell, Anna Bower, Eric Columbus, and Parloff to discuss litigation over Trump’s new tariffs, a hearing in Anthropic’s suit challenging the Pentagon’s supply chain risk designation, recent filings by James Comey in the “86” seashells prosecution, and more.

---

Today’s #BeastOfTheDay is the squirrel, seen here succumbing to just punishment for its hubris:

Video Source

In honor of today’s Beast, remember that you too are mortal.

---

Tell Me Something Interesting

My dear friends in the Greek Chorus, I—EJ Wittes—have found something not just interesting, but also cute, and I need your help with it.

My attention was drawn this weekend by an anecdote in Veronique Dasen’s invaluable book Play as Metaphor: Ludic Images from Ancient Greece. In the fifth chapter, Dasen, discussing children’s imitation of religious rituals, writes: