Anthropic recently submitted two sworn declarations to a California federal court, refuting the Pentagon’s assertion that the AI company constitutes an “unacceptable risk to national security.” The company contends that the government’s arguments are based on technical misconceptions and points that were never raised during the extensive negotiations preceding the current dispute.
These declarations were filed along with Anthropic’s reply brief in its ongoing lawsuit against the Department of Defense, ahead of a hearing scheduled for Tuesday, March 24, before Judge Rita Lin in San Francisco.
The conflict originated in late February when President Trump and Defense Secretary Pete Hegseth publicly announced the termination of their association with Anthropic, following the company’s refusal to permit unrestricted military deployment of its AI technology.
The individuals who provided these declarations are Sarah Heck, Anthropic’s Head of Policy, and Thiyagu Ramasamy, the company’s Head of Public Sector.
Heck, a former official with the National Security Council who served at the White House during the Obama administration before working at Stripe and then Anthropic, manages the company’s government relations and policy initiatives. She was personally present at the February 24 meeting where CEO Dario Amodei met with Defense Secretary Hegseth and the Pentagon’s Under Secretary Emil Michael.
In her declaration, Heck highlights what she describes as a fundamental inaccuracy in the government’s submissions: the assertion that Anthropic sought an approval role over military operations. She explicitly states this claim is untrue, writing, “At no time during Anthropic’s negotiations with the Department did I or any other Anthropic employee state that the company wanted that kind of role.”
She further asserts that the Pentagon’s concern regarding Anthropic’s potential to disable or modify its technology during ongoing operations was never brought up during negotiations. Instead, she notes, this issue first appeared in the government’s court filings, denying Anthropic any chance to respond.
Another significant detail in Heck’s declaration is that on March 4 — the day after the Pentagon formally concluded its supply-chain risk designation against Anthropic — Under Secretary Michael emailed Amodei, indicating that the two parties were “very close” on the two issues the government now cites as proof of Anthropic’s national security threat: its stances on autonomous weapons and mass surveillance of Americans.
This email, included as an exhibit in Heck’s declaration, provides a crucial contrast to Michael’s subsequent public remarks. On March 5, Amodei released a statement mentioning that the company had been engaged in “productive conversations” with the Pentagon. The following day, Michael posted on X, stating, “there is no active Department of War negotiation with Anthropic.” A week later, he informed CNBC there was “no chance” of further discussions.
Heck’s argument suggests a critical inconsistency: if Anthropic’s positions on these two matters indeed posed a national security threat, why was a Pentagon official asserting near-alignment on those very issues immediately after the designation was finalized? (While she doesn’t explicitly state the government used the designation as leverage, the chronology she presents raises that possibility.)
Ramasamy contributes distinct technical expertise to the case. Before joining Anthropic in 2025, he spent six years at Amazon Web Services, overseeing AI deployments for government clients, including in classified environments. At Anthropic, he is recognized for establishing the team responsible for integrating its Claude models into national security and defense applications, including the $200 million contract with the Pentagon announced last summer.
His declaration addresses the government’s assertion that Anthropic could theoretically disrupt military operations by deactivating or altering its technology. Ramasamy states this is technically impossible, explaining that once Claude is deployed within a government-secured, “air-gapped” system managed by a third-party contractor, Anthropic has no access. He clarifies there is no remote kill switch, no backdoor, and no way to push unauthorized updates. He suggests any notion of an “operational veto” is fictitious, as any modification to the model would necessitate explicit Pentagon approval and action for installation.
Anthropic, he clarifies, cannot even view what government users input into the system, let alone extract that data.
Ramasamy also disputes the government’s claim that Anthropic’s employment of foreign nationals poses a security risk. He highlights that Anthropic employees undergo U.S. government security clearance vetting—the same rigorous background check required for access to classified information—and adds that, “to my knowledge,” Anthropic is the only AI company where cleared personnel actually developed AI models intended for classified environments.
Anthropic’s lawsuit contends that the supply-chain risk designation—the first ever applied to an American company—constitutes government retaliation for the company’s publicly stated perspectives on AI safety, thereby violating the First Amendment.
Conversely, the government, in a 40-page filing earlier this week, rejected this characterization entirely, arguing that Anthropic’s refusal to permit all lawful military uses of its technology was a business decision, not protected speech, and that the designation was a direct national security judgment, not a punishment for the company’s views.