Supreme Court Ruling Could Threaten Cybersecurity Regulation and Rules

A recent Supreme Court ruling has significantly altered the landscape of regulatory enforcement in the United States, with profound implications for cybersecurity regulation. On June 28, 2024, the Supreme Court overturned the Chevron Doctrine, a legal principle established in 1984 (Chevron v. Natural Resources Defense Council) that allowed federal agencies to interpret ambiguities in the law using their expertise. This doctrine has been the cornerstone of the federal regulatory system for four decades, enabling agencies to create and enforce rules with technical expertise and efficiency.

The Supreme Court’s decision mandates that courts must now exercise independent judgment when determining whether an agency has acted within its statutory authority. This ruling effectively removes the need for courts to defer to agency expertise in cases involving ambiguous statutes, overturning a practice that has been in place for forty years. According to the Supreme Court, "The Administrative Procedure Act requires courts to exercise their independent judgment in deciding whether an agency has acted within its statutory authority, and courts may not defer to an agency interpretation of the law simply because a statute is ambiguous; Chevron is overruled."

This shift has significant repercussions for cybersecurity regulation in the US, which is predominantly managed by federal agencies such as the FDA, the SEC, and the DHS. These agencies have historically relied on their expertise to interpret and enforce cybersecurity laws and regulations. However, with the Supreme Court's ruling, judicial oversight will now play a more significant role in these matters, potentially leading to increased litigation and challenges to agency decisions.

Ilia Kolochenko, attorney-at-law with Platt Law LLP and CEO at Immuniweb, remarked, "This landmark decision from the US Supreme Court will likely have tectonic and long-lasting consequences for administrative rulemaking in the US. By overruling the 40-year-old Chevron doctrine, the Supreme Court gave significantly more judicial power and leeway to courts in the interpretation of federal law that may be vague, unclear, or just silent on certain elements, such as cybersecurity, privacy, or data breach disclosure."

The ruling implies that businesses can now appeal agency decisions without the courts deferring to the agencies' expertise. This could lead to an increase in legal challenges and appeals, with well-funded companies potentially treating US regulations similarly to how they approach EU regulations—through extensive legal battles. Ken Dunham, director of cyber threat at Qualys TRU, anticipates "a tsunami of litigation for federal agencies and/or officials, who will now be able to be sued in perpetuity for decisions made."

Harvard Law School professor Jody Freeman adds, "It’s a massive power shift back to the courts and away from agencies. And to put this in context, this is part of a series of cases in which the Supreme Court has made it harder for agencies to do their job."

This development raises concerns about the future of cybersecurity regulations. Kolochenko points out that courts may now invalidate administrative rules they find inconsistent with statutory purposes, affecting rules on cybersecurity, breach disclosure, and critical national infrastructure. This includes recent initiatives like the CISA's CIRCIA rules, which require extensive reporting of cyber incidents from critical infrastructure sectors. With the new judicial oversight, these rules are more susceptible to being overturned.

Jason Porter, VP and CTO at Optiv + ClearShark, notes, "This change will likely result in more regulatory actions being challenged and ultimately overturned, leading to legal uncertainty for regulatory bodies and the industries they oversee."

While the Supreme Court's ruling poses several challenges, there may also be some positive outcomes. Aaron Rose, office of the CTO at Check Point Software, sees potential benefits, such as forcing Congress to draft more precise legislation and ensuring agencies base their regulations on clear legal standards. Increased judicial oversight could lead to more consistent and fair rulings based on established legal principles.

However, Rose also highlights the drawbacks: "With the rapid evolution of technology, particularly in cybersecurity, timely adaptation is critical. The Supreme Court’s decision could slow down the implementation of necessary measures, leaving gaps for hackers and bad actors to exploit."

In conclusion, the Supreme Court's decision to overturn the Chevron Doctrine has ushered in a new era of regulatory oversight, shifting power from expert agencies to the judicial system. While this change aims to ensure that regulations are grounded in clear legal principles, it introduces uncertainty and potential delays in the rapidly evolving field of cybersecurity. As the legal landscape adapts to this ruling, the challenge will be to balance judicial oversight with the need for expert-driven, timely, and effective cybersecurity regulations.