Separation of Powers and Cybersecurity

Overview
The U.S. Constitution divides powers relating to national security between the executive and legislative branches.


 * Article I of the U.S. Constitution empowers Congress to "declare war," "raise and support armies," "provide and maintain a navy," and "make rules for the government and regulation of the land and naval forces."
 * Article II states that the "President shall be Commander in Chief of the Army and Navy of the United States, and of the Militia of the several States."

As a preliminary matter, invocation of war powers begs a question regarding the scope of the Commander in Chief's role in a modern conflict that, not least in the context of cyber warfare, defies traditional military strategies. Many facets of cybersecurity, such as components directing planning, development, and education, fall outside of traditional definitions of war. In addition, war powers would likely not apply to actions which mandate private sector security measures. However, many believe the Commander-in-Chief power extends beyond warfare to encompass a broad conception of national security. In addition, although the phrase "war powers" evokes international conflicts, it seems that the President's war powers authorize at least some domestic action. For example, some have argued that the President's Commander-in-Chief power authorizes him to create a domestic intelligence agency.

Alternatively, the President's foreign affairs powers might provide an inherent constitutional authorization for executive action on cybersecurity. Given modern communications technology and the ease of travel, it is increasingly difficult to draw clean lines between foreign and domestic affairs. Congress' attempts to distinguish between foreign and domestic actors in other areas impacted by rapidly changing technological environments serve as examples. For instance, in the context of electronic surveillance, statutory provisions have progressed from drawing definitive distinctions between people located in the United States versus abroad in the original Foreign Intelligence Surveillance Act of 1978 to a 2007 amendment excluding from the scope of foreign surveillance any person "reasonably believed" to be located abroad.

Finally, the President might assert that his oath-based obligation to defend the nation from imminent threats, sometimes termed the "emergency theory," provides a constitutional basis for executive action to prevent cyber intrusions or attacks. Presidents have relied on this authority very rarely.

Assuming that the President's war or foreign affairs powers extend to national security efforts such as the Comprehensive National Cybersecurity Initiative, the next question is whether, and in what circumstances, the executive branch exercise of such powers might be constrained by congressional action. As discussed, Congress and the President share powers to address matters of national security, and no precise line divides the powers of the two political branches. Some have identified a narrow sphere of Article II authority, sometimes called "preclusive" power, which congressional action cannot limit. For most situations, however, Justice Robert Jackson's concurring opinion in Youngstown Steel & Tube Co. establishes the leading doctrine governing the executive's inherent constitutional authority vis-a-vis Congress. Justice Jackson's three-category framework requires courts to evaluate, where possible, the interplay between congressional intent and executive action in the context of the Constitution's allocation of powers. This exercise is made more difficult by the murky nature of a small category of inherent constitutional powers some believe are reserved to the President alone.

During the Korean War, President Truman signed an executive order directing the Commerce Secretary to take control of the nation's steel mills in order to prevent a national steelworkers' strike. In Youngstown, also known as the "Steel Seizure Case," the government claimed that presidential powers inherent in Article II provisions, most notably the Commander-in-Chief power, authorized President Truman's action. To prove this claim, the government characterized the industry seizure as an action of a Commander-in-Chief, prompted by exigencies of war: steel production was necessary for military operations in Korea. The Supreme Court rejected this claim, but justices reached the conclusion by different analytical routes.

Writing for the majority, Justice Black took the hard-line view that the Commander-in-Chief clause gives the President no substantive authority. He emphasized that controlling private property to affect labor disputes "is a job for the nation's lawmakers." In contrast, Justice Jackson argued that the President's inherent constitutional powers "fluctuate," from relatively high when authorized by Congress, to their "lowest ebb" when a president "takes measures incompatible with the express or implied will of Congress." Specifically, Justice Jackson articulated three categories of executive action: (1) action supported by an express or implied grant of authority from Congress; (2) a “zone of twilight” between the other categories, in which “congressional inertia” can occasionally “enable, if not invite, measures on independent presidential responsibility”; and (3) action that conflicts with statutes or congressional intent.54 Actions in the first category enjoy congressional support and thus might not need to rely solely on an inherent constitutional powers argument; assuming that Congress acted pursuant to an enumerated Article I power in delegating the authority, these actions are clearly authorized unless they violate another constitutional provision. Actions in the second, “zone of twilight”55 category prompt a complicated, totality-of-the circumstances inquiry, in which courts determine congressional intent vis-a-vis executive action. Actions that fall within the third category – that is, actions that conflict with statutory law – generally lack constitutional authority, unless the action is one of the few types of actions over which the President has exclusive authority. In Youngstown, Justice Jackson found that President Truman’s actions fit within the third category, because Congress had not left the issue of property seizure during labor disputes to an “open field”; rather, Congress had passed statutes designed to stabilize markets when government required supplies.56 On this basis, Justice Jackson joined the majority to strike down President Truman’s seizure of the steel industry.57

Given the existing statutory framework, at least some potential responses to cyber threats would likely fall outside of the first of Justice Jackson’s categories. Congress has not expressly authorized the cybersecurity reforms proposed by the CNCI, nor do the Federal Information Security Management Act or related statutes appear to impliedly authorize all potential cybersecurity protections. In addition, although the use of cyber force might have congressional authorization under the 2001 Authorization for Use of Military Force58 if directed against an al Qaeda or Taliban operative, the Supreme Court has appeared to foreclose reliance on the Authorization as a basis for any action that is not a “fundamental” incident to the use of force against those responsible for the 9/11 attacks. The 2001 joint resolution authorized the use of “all necessary and appropriate force against those nations, organizations, or persons he determines planned, authorized, committed, or aided” the 9/11 attacks.59

In Hamdi v. Rumsfeld, the Supreme Court held that capture and detention of Taliban members constituted “so fundamental and accepted an incident to war as to be an exercise of the ‘necessary and appropriate force’ Congress has authorized the President to use.”60 The Court seemed reluctant to interpret the Authorization as extending to detentions beyond this “limited category.”61 Cyber security efforts that focus on information gathering activities may parallel the role of intelligence collection as a “central