Agency Rules and Regulations Are Not Laws

In January, in one of the most riveting cases of the current session, the Supreme Court ruled 7-2 in favor of Transportation Security Administration (TSA) whistleblower Robert MacLean, holding that agency rules and regulations do not equate to laws. Chief Justice John Roberts wrote the majority opinion for the Court. And now that we’ve had time to celebrate the victory for MacLean, it’s time to turn our focus to what Department of Homeland Security v. MacLean may mean for whistleblowers in general.

Current federal whistleblower protection law—the Whistleblower Protection Act (WPA)—protects individuals against backlash from employers for disclosing information about “any violation of any law, rule or regulation” or “a substantial and specific danger to public health or safety” by a federal agency. However, in the same statute there exists an exception for disclosures that are “specifically prohibited by law.”

The question the Court sought to answer was whether MacLean’s disclosures were “specifically prohibited by law.”

The Homeland Security Act of 2002 states that the TSA’s “Under Secretary shall prescribe regulations prohibiting the disclosure of information obtained or developed in carrying out security” if they decide that the disclosure of that information would “be detrimental to the security of transportation.” The resultant regulations thus prohibit the disclosure of “sensitive security information” (SSI) without the proper authorization. Among the various types of information that could be designated SSI is “information concerning specific numbers of Federal Air Marshals, deployments or missions, and the methods involved in such operations.”

The government argued that MacLean’s disclosures were “specifically prohibited by law” and that the WPA did not offer protection for two reasons: 1) the disclosure was prohibited by specific TSA regulations on SSI; and 2) the Homeland Security Act authorizes the TSA to promulgate the regulations.

The Court addressed and subsequently rejected both arguments, affirming the judgment in favor of MacLean by the U.S. Court of Appeals for the Federal Circuit.

The Court rejected the government’s argument that a disclosure that is prohibited by regulation is also “specifically prohibited by law,” as prescribed by federal whistleblower statute.

The Court elaborates that in the WPA Congress repeatedly used the phrase “law, rule, or regulation,” but did not use the same phrase in the statutory language at question in this case. Instead, Congress used the word “law” alone, suggesting that it meant to exclude rules and regulations from the specific stipulation. Congress’s omission of “rule, or regulation” must be viewed as deliberate because of the use of “law” and “law, rule, or regulation” in the same sentence, as well as the frequent use of the latter phrase throughout the statute. These “two aspects of the whistleblower statute make Congress’s choice to use the narrower word “law” seem quite deliberate,” opined the Court.

After creating an exception for disclosures “specifically prohibited by law,” the WPA also creates a second exception for information “specifically required by Executive order to be kept secret.” The second exception is limited to actions taken by the President, and thus suggests that the first exception and the use of “law” is limited to actions by Congress.

The Court also reasons that “If ‘law’ included agency rules and regulations, then an agency could insulate itself from the scope of Section 2302(b)(8)(A) merely by promulgating a regulation that ‘specifically prohibited’ whistleblowing.” Instead, “Congress passed the whistleblower statute precisely because it did not trust agencies to regulate whistleblowers within their ranks.” The Court concluded that “it is unlikely that Congress meant to include rules and regulations within the word ‘law’” and that the specificity of the phrase “specifically prohibited by law” was meant to deliberately exclude rules and regulations.

In rejecting the Government’s second argument, that MacLean’s disclosure violated the Homeland Security Act, the Court held that in actuality the “statute does not prohibit anything.” Although the statute stipulates that the TSA “shall prescribe regulations prohibiting the disclosure of information obtained or developed in carrying out security…if the Under Secretary decides that disclosing the information would…be detrimental to the security of transportation,” the Court concluded that it only authorizes the Under Secretary to “prescribe regulations.”

Because determining which documents meet the standard of “detrimental to the security of transportation” requires the exercise of considerable judgment, the Court stated that the language “affords substantial discretion to the TSA in deciding whether to prohibit any particular disclosure.” The statute does not actually prohibit disclosure of information but instead gives authority to an agency to determine whether there is a prohibition. In sum, the statute gave the TSA the power to create a prohibition; the statute itself did not create one. Therefore MacLean’s disclosure was not “prohibited by law” because it did not violate the Homeland Security Act, and he is thus protected by the WPA.

Justice Sotomayor, joined by Justice Kennedy, authored the dissenting opinion and agreed with the majority in part. The dissent had “no qualms with the Court’s conclusion that the phrase ‘specifically prohibited by law’…does not encompass disclosures prohibited only by regulation.” However, they concluded that the Homeland Security Act did explicitly prohibit the disclosed information in question by obligating the TSA to enact regulations to prevent such disclosure.

The importance of this case extends far beyond the scope of MacLean or the DHS. The ruling set a precedent that protects whistleblowers against prohibitions on disclosure set by agency rules and regulations. In order for a whistleblower to be excluded from WPA protection under the “specifically prohibited by law” clause, Congress must pass a law that prohibits the disclosure of that information. Although the Homeland Security Act authorized the creation of regulations prohibiting disclosure, the regulations themselves do not have the force of law. By ruling that agency rules and regulations are not laws, the Court ruled that MacLean’s disclosures were protected by the WPA. More importantly, the Court’s ruling hardened the line between executive and legislative branch power by declaring that agencies’ rules and regulations do not have the force of a legislatively passed statute; this extends to all agencies under the executive branch.