Today a three-judge panel of the U.S. Court of Appeals for the D.C. Circuit unanimously ruled that the TSA deployment of virtual strip-search machines is subject to the requirements of the Administrative Procedure Act for formal notice and an opportunity for public comment before it is put into effect.

[T]he TSA has advanced no justification for having failed to conduct a notice-and-comment rulemaking. We therefore remand this matter to the agency for further proceedings. Because vacating the present rule would severely disrupt an essential security operation, however, … we shall not vacate the rule, but we do nonetheless expect the agency to act promptly on remand to cure the defect in its promulgation.

The ruling came in a lawsuit by EPIC based on a petition for rulemaking in which the Identity Project had joined.

The logic of the decision would appear to apply equally to other requirements imposed on travelers at TSA checkpoints, including any mandate for travelers to identify themselves:

[W]e conclude the TSA’s policy substantially changes the experience of airline passengers and is therefore not merely “interpretative” either of the statute directing the TSA to detect weapons likely to be used by terrorists or of the general regulation requiring that passengers comply with all TSA screening procedures. Although the statute, 49 U.S.C. § 44925, does require the TSA to develop and test advanced screening technology, it does not specifically require the TSA to deploy AIT scanners let alone use them for primary screening. Concededly, there is some merit in the TSA’s argument it has done no more than resolve an ambiguity inherent in its statutory and regulatory authority, but the purpose of the APA would be disserved if an agency with a broad statutory command (here, to detect weapons) could avoid notice-and-comment rulemaking simply by promulgating a comparably broad regulation (here, requiring passengers to clear a checkpoint) and then invoking its power to interpret that statute and regulation in binding the public to a strict and specific set of obligations….

Finally, the TSA argues notice and comment is not required because, rather than promulgating a legislative rule, the agency, in announcing it will use AIT for primary screening, made a “general statement[] of policy.” The question raised by the policy exception “is whether a statement is … of present binding effect”; if it is, then the APA calls for notice and comment….

The TSA seems to think it significant that there are no AIT scanners at some airports and the agency retains the discretion to stop using the scanners where they are in place. More clearly significant is that a passenger is bound to comply with whatever screening procedure the TSA is using on the date he is to fly at the airport from which his flight departs. 49 C.F.R. § 1540.105(a)(2) (no passenger may enter the “sterile area” of an airport “without complying with the systems, measures, or procedures being applied to control access to” that area). To be sure, he can opt for a patdown but, as the TSA conceded at oral argument, the agency has not argued that option makes its screening procedures nonbinding and we therefore do not consider the possibility. We are left, then, with the argument that a passenger is not bound to comply with the set of choices presented by the TSA when he arrives at the security checkpoint, which is absurd. *

* The TSA’s argument it has not promulgated a “rule” also fails because the question at issue is again whether the agency’s pronouncement is or purports to be binding.

We asked the DHS again today, but, like the TSA, they still won’t say whether they plan to claim authority to compel travelers to identify themselves, or propose any explicit ID rule.

The TSA can ignore public comments, of course. But requiring notice and comment would prevent the TSA from enforcing secret laws. And unlike secret laws — which by their very secrecy can evade judicial review — requiring notice and comment provides a clear procedural path to judicial review of whatever rules are adopted after the notice and comment.

The Court of Appeals also found that — as of now — there was insufficient evidence to show that the TSA’s use of virtual strip-search machines violates any Constitutional rights. That may mean that today’s ruling has more effect on other TSA requirements, such as those for identification of travelers, rather than on the issue of virtual strip-searches. But the notice and comment process will provide an opportunity to develop more evidence of Constitutional or other legal violations in the TSA’s use of virtual strip-search machines. And while Fourth Amendment protections against unreasonable warrantless searches were raised in this lawsuit, the right to travel — as protected by the Constitution, federal law, and international human rights treaties — was not raised in this case. Federal law (49 USC § 40101, part of the Airline Deregulation Act of 1978) expressly requires the TSA to consider “the public right of freedom of transit” by air when it issues regulations, so the right to travel will be directly at issue in the upcoming rulemaking process and any follow-up litigation.

Opponents of the “virtual strip-search or genital groping” policy should get ready to inundate the TSA  with comments from objecting members of the public as soon as the proposed rule is published. We confidently predict that this proposal will generate the largest volume of public comment in the history of DHS rulemaking.