Impact of the Supreme Court’s Chevron Ruling with Huntress’s Brian Arnold

This is Textron tv. Hey guys, thanks to Thera. We're here with Brian Arnold, who's director of Legal Affairs for Huntress, and we're talking about this new Chevron doctrine ruling, which is a little arcane, but turns out to have a massive impact on just about everything we think about compliance.

Hey Brian, welcome to the show. Yeah, thanks for having me, Mike. Yeah, this was a, this was kind of a seminal decision, kind of went under the radar to the non-lawyer types, I think.

Um, but it really could have a ripple effect in a lot of areas, uh, around the country in particular, agency law and how the congress and courts all, all interact. And it really, it, it related to this thing called the Chevron doctrine. Chevron case was a seminal case by the Supreme Court 40 years ago.

And what it basically said was, where Congress has empowered an agency to enforce and create rules related to a particular law that courts would then provide some kind of deference or chevron deference to agency's decisions. And it really provided a lot of certainty that if the agency was going to make some decisions or promote some rules, that those would be the rules that would be applied. Really, the only time courts would overturn an agency's decision if they found that somehow their interpretation of the law or enforcement of it was arbitrary or capricious or just manifestly contrary to the statute.

So that's the world that we lived in for the last 40 years. It was a seminal Supreme Court case that I studied and every other lawyer, um, studied in law school two months ago, or about a month and a half ago. The Supreme Court, uh, ruled on this same concept and specifically overturned the Chevron doctrine in, in a case called Loper Wright Enterprises.

It found that, um, based on their interpretation of the role of the judiciary, that they didn't have to and should not defer to an agency in interpreting a statute. And so they specifically overturned Chevron and, and found that it is the court's decision. It's their traditional role to say what the law means and therefore going forward, a court can consider what an agency's interpretation of a statute was, but they no longer had to defer to it at all.

It, um, it, it may have ha have power to persuade if it was well thought out, but really the court ultimately must make the determination on their own with their own independent judgment. So that's the synopsis of what the court did. And this would affect everything from SEC compliance to potentially any forthcoming rule agency rules on, say, sustainability or whatever else that we're thinking about coming down the pike, maybe even ai.

Um, does this create a level of uncertainty that is maybe bad for business because we don't know what to expect and then every case will now be, uh, adjudicated as it were? It, it absolutely has that potential. You're right, it covers many industries.

Virtually every area. There are dozens of federal agencies and they all interpret and enforce laws. So potentially any of those actions, if a business or a somebody who's charged with something disagrees, they could, they could challenge that agency.

So you could, you could have a lot of uncertainty in how laws are being in interpreted effectively. What this did was it kind of switched the balance of power from, you know, the executive branch to more congress and ju judiciary here. Um, and it, it really has the potential to cause a lot of imbalance and, uh, uncertainty across a number of industries, but especially ones that are swift moving and high tech, like ai, cybersecurity issues.

Congress can't keep up with the pace with which technology changes and how, um, threat actors, for example, are acting. And so there's gonna be a lot of uncertainty if there are new laws and regulations that need to be implemented. But Congress cannot do it if an agency implements their own rules and regulations and tries to get their arms around something.

You may not have the certainty that you once did that that was actually law. Mm-Hmm. Do you think that this will impact spending in areas where we spend a lot of money on governance, risk management, compliance, GRC will organizations kinda stand pat?

'cause they'll be like, well, there's fewer of these regulations that might be, uh, applied or relevant to us. So, um, what's the downstream impact? Um, I don't think it will affect the amount of money or it shouldn't affect the amount of resources put towards things like cybersecurity, because I think you're still going to have, the federal government is still going to be promoting laws and trying to push laws and enforce them.

You're gonna actually probably have a landscape where there's a little more unknown unknowns. You may need to be a little more conservative in how you're rolling out technology to make sure that under any interpretation of what you need to do, that you are compliant. Um, you're gonna have to be spending probably more money on, on legal fees just to make sure that you can comply and respond to legislative or, uh, agency decisions As we go forward.

Um, do you think that, uh, we will not make as much progress as we might in various sectors just because everyone will wait for someone else to be the Guinea pig for a court case that will then decide a particular issue? I think that is certainly a possibility. It, it depends, I think, on how the, the sector reacts, how the public and private sector reacts.

If they all sit back and take a wait and see approach and let other people take pot shots, then yeah, I think that that could, could be the case. Mm-Hmm. So what's your best advice to folks as they kind of look at all of this?

'cause I think depending sometime, uh, where you are on the political spectrum, you may be, you know, happy as a clam. And on the other end you may be saying, this is the worst thing ever. So as a business, what am I supposed to do?

Well, like I alluded to earlier, I thi I think the best defense here really for an organization, whether you're a cybersecurity firm who provides services to its customers or you're an organization that needs to defend itself, I think the best defense here is a good offense. Make sure that you have a strong security posture. Follow some of the frameworks that are put out out there, the National Cybersecurity strategy that's put out by the administration that is tasking various agencies of coming up with rules.

I think organizations should continue to monitor and try to layer in dis defense in depth, uh, techniques to try to help protect yourself. With all due respect to the judiciary, they're not always experts in the particular field that they are now gonna be making rulings in. No, and I'm not sure they're comfortable making those rulings either because, uh, for better or worse, at least the agencies had some people on staff who, you know, followed that some area closely and knew the industry better.

Yeah, no, that's absolutely true. I, I think there's two, two things that are gonna have to be done here to try to avoid having, uh, technology adverse judges make rulings on highly technical issues. I think if there are litigations, I think you're gonna have to spend a lot of money on judicial, um, education on the technologies.

It happens a lot in other areas. I've done a lot of patent litigation with high tech software type stuff, and you spend a lot of money on education of the judges and special masters and just what the technology means and how it works. I think litigants are gonna have to spend a lot of money if they get into these situations where they're challenging the agency's decisions to try to educate them on what the technology means.

I think the best way to avoid that I, I think is for the private sector to become proactive and try to work with the public sector and get congress to actually pass meaningful cybersecurity laws that don't have the ambiguities in there that could create these lawsuits have, have, uh, cybersecurity laws that are flushed out, at least to protect the critical infrastructure sector section of, of the United States. I think that's the best bet for avoiding these costly litigations. The passing in laws is not something we've seen a whole lot of lately.

Um, so my question is, will the legislative branch look at this and may hopefully be spurd the act more in line with your thinking? 'cause they're gonna be like, Hey, we can't have all this stuff tying up our court systems. Yeah, that, I mean, that's my hope.

Commentators do disagree, but security of the critical infrastructure is, is kind of a bipartisan issue to some extent. Both parties do have it as one of their priorities. So hopefully that there will be the opportunity, especially with the industry really weighing in, um, you know, watchdog groups, private business, everybody lobbied to get some certainty around this.

I think that will help spur something that should be relatively bar bipartisan. It should help spur Congress to, to pass some laws. And you're right, they have not passed too many laws there.

There was a recent law passed a couple years ago that currently is in the rule phase with the CSA right now, that they're having to evaluate what this Loper decision means for the, uh, cybersecurity infrastructure and security agency, um, when they're trying to implement, so the latest law that Congress passed, so it's gonna create a little bit of a headache there too. There was this place called K Street in Washington, DC where all those lobbyist firms live. Is, is all the money gonna start pouring in there to kind of influence these decisions?

Is that gonna be a byproduct of all this? I, I think it, it's certainly possible. I certain, I certainly do think that they will, they will take their swing, swing at it.

I used to be a partner at a firm that we had an office on K Street. I wasn't a lobbyist, but it was definitely a busy industry back then. And I don't think it's gonna slow down any, but I do think that that is one avenue to try to get the certainty here that I think the industry needs, regardless of your views of lobbyists and and that industry, Um, will this ampath our ability as a country to compete more effectively because, well other countries where the rules are more certain, we'll just see people moving ahead faster than we are because business people don't like uncertainty.

They don't like risks, so they won't act if they don't know for certain that yeah, this thing that they want to do is they gonna be declared illegal three years out. Yeah, I mean, definitely traditionally the US has been a leader in a lot of areas including technology and, you know, the rest of the world tends to work collaborative collaboratively with the US and follow. But it may get to the point where maybe for a short time, if there is some uncertainty while we're trying to straighten it out, that, uh, other countries might have to take the lead, we might have to follow.

Mm-Hmm. What about the states? Won't they kind of attempt to step up and fill this void a little bit and we'll see states like, well, the big ones, California or New York will make a rule and um, hopefully we won't wind up with 50 different flavors of a rule, but, uh, maybe the others will follow one or two.

That's, that's certainly possible. It's happening in the, the privacy world right now, we don't have a federal privacy regime at all. We have segmented industry privacy laws like healthcare and the financial industry, but certain states have, um, enacted their own privacy legislations that you mentioned in California, Texas, Virginia.

There, there's a host of them now, and it, it will probably, those will probably be added on in a lot of states. So you could end up with this patchwork of different, uh, rules and regulations that you have to follow if you're a multi-state business, you know, like, like we are, we have to follow these, these laws in all these states. It really would behoove the industry public and private sector to work together to create a national regime, a national cybersecurity and data privacy like program.

All right, do we need some bipartisan efforts here that are maybe led by the private sector before we get to the public sector where folks are getting together and helping to maybe define what they think is a policy that's reasonable and then bring that to the legislative branch before we, uh, let a bunch of to be kind bureaucrats who are not specialists, kinda make some decisions that might have more to do with, uh, the level of pork in their state than the actual benefit of the country? Yeah, I mean, certainly I think that having a strong presence by the private sector is critical whether they take the lead or work collaboratively with a lot of these agencies, because remember there are agencies that have specialists and some of the best cybersecurity people in minds are in some of these agencies, and that's why they're tasked with pro uh, promoting their own rules and enforcing them in different pockets in different sectors. I think it, it's gonna have to be a collaboration between the agencies and the private sector, but the private sector has to, has to be a part of that and they have to be one of the, the primary drivers of it, for sure.

Right. Last question. Are you worried about any brain drain from the agencies who may just throw up their hands and say, Hey, you guys have, uh, essentially taken the ball out of our hands, so let us know how it all turns out and we're going back to the private sector.

I mean, that, that certainly happens in, um, election years and you know, when you, when you follow an administration change, that just naturally happens a lot. I think that is always a risk with the cybersecurity, uh, expertise that you have in the government because the private sector pays more and there is such a lack of cybersecurity professionals and, and brain power just in general throughout the world that I think the government is always at risk of their people being poached. And if their work product is being torn apart by the courts, I can certainly see that it would be more attractive to just get out of that game and go into the private sector for sure.

All right folks. Well, for better or worse, right now, there's more unknown than known and we're gonna have to see how all this plays out, but brush your fingers and that, uh, reason prevails. Hey Brian, thanks for being on the show.

Yeah, thanks Mike. Thanks for having me. All right.

And back to you guys in the.