Consolidated with 23-1328

On Petitions for Review of a Final Action of the Transportation Security Administration

Melissa C. Allison argued the cause for petitioners. With her on the briefs were David S. Mackey and Carlos R. Rosende . Leif Overvold , Attorney, U.S. Department of Justice, argued the cause for respondents. With him on the brief were Brian M. Boynton , Principal Deputy Assistant Attorney General, and Sharon Swingle , Attorney.

Page 2Before: SRINIVASAN, Chief Judge , WALKER, Circuit Judge , and ROGERS, Senior Circuit Judge .

Opinion for the Court filed by Chief Judge SRINIVASAN.

SRINIVASAN, Chief Judge : In 2020, the Transportation Security Administration proposed a rule to address “ insider threats ” in secure d areas in airports — the danger that aviation workers with unescorted access to secured airport areas could enable weapons or other dangerous items to be brought on board aircraft. The agency, however, did not give notice of the proposed rule to the public or allow for public comments. Rather than apply ordinary notice-and-comment procedures, TSA gave notice and an opportunity to comment to airport operators alone.

TSA finalized its rule nearly three years later. The final rule, which the parties call the ' National Amendment, ' requires the nation's largest airports to physically screen aviation workers entering certain secured areas. The National Amendment also requires airport operators to purchase and deploy explosivesdetecting equipment. An airport operator’s failure to comply with the rule's requirements can result in a civil enforcement action brought by TSA.

Petitioners challenge the National Amendment on various grounds, including that TSA had to go through notice-andcomment procedures to promulgate the rule. Because we agree with petitioners on that ground, we have no occasion to reach their remaining challenges. In view of the security risks that might come about in the absence of the rule, we will withhold our mandate, setting it aside until TSA adopts a new rule or informs the court that it no longer believes any rule is necessary.

Page 33

A.

Congress required the Transportation Security Administration (TSA) to mandate background checks for 'airport security screening personnel' and other individuals with access to secured areas in airports. 49 U.S.C. § 114(f)(12). TSA must also “prescribe regulations to protect passengers and property' from criminal activity. Id. § 44903(b). And it must provide for the screening of all “passengers” boarding flights in the United States and of any property “that will be carried aboard a passenger aircraft. ” 49 U.S.C. § 44901(a) .

Congress additionally vested TSA with broad authority over airport operators to ensure that the agency could carry out its duty to 'shore up our nation's civil aviation security.' Olivares v. TSA , 819 F.3d 454, 459 (D.C. Cir. 2016); see, e.g. , 49 U.S.C. §§ 114(l)(1), 44903(g)(2)(A). And Congress transferred the enforcement of various regulations governing access to secured airport areas from the Federal Aviation Administration — which had originally promulgated them — to TSA.

Under those regulations, airport operators must adopt and implement a TSA-approved security program that prevents 'the introduction of an unauthorized weapon, explosive, or incendiary onto an aircraft.” 49 C.F.R. § 1542.101(a)(1) ; see also id. §§ 1542.103, 1542.105(a). The regulations also require airports to 'establish at least one secured area' and take measures to “prevent and detect . . . unauthorized entry' there. Id. §§ 1542.201(a), (b)(1). Secured areas include areas in which passengers board and deboard a plane and luggage is sorted and loaded. Id. § 1540.5. The regulations require Page 4airports that regularly service large aircraft to maintain a “security identification display area” (or SIDA) at each secured area and other areas in the airport. Id. §§ 1542.205(a)(1) – (3). Airports subject to that requirement must establish an identification system to 'prevent the unauthorized presence and movement of individuals in the SIDA' and train their employees before granting them unescorted SIDA access. Id. §§ 1542.205(b)(1), (3).

Airport operators wishing to modify their approved security programs must submit a request to a designated TSA official, who can approve the proposed amendment upon concluding that “safety and the public interest will allow it.” Id. § 1542.105(b)(3). Alternatively, TSA can itself amend a security program if it determines that doing so would benefit 'safety and the public interest.' Id. § 1542.105(c). Before finalizing such a sua sponte amendment, the agency must give the affected airport operator notice and an opportunity to comment on the proposal. Id. § 1542.105(c)(1).

In recent years, TSA and Congress have grown increasingly concerned about the security risk posed by airport workers with unescorted access to secured airport areas, who can usually enter those areas without undergoing any physical screening. See, e.g ., FAA Extension, Safety, and Security Act of 2016, Pub. L. No. 114-90, § 3407 (2016) (directing TSA to “expand the use of transportation security officers and inspectors to conduct . . . physical inspections of airport workers”) . TSA fears that airport workers could give terrorist groups and criminal organizations a potential means of gaining access to secured areas without a security screening. Although present efforts to mitigate insider threats — primarily, vetting Page 5before granting unescorted access — have generally proved effective, TSA has come to believe that more is warranted.

In October 2020, TSA sought to address its concerns by requiring airport workers to undergo random physical inspections before entering certain secured areas. Instead of initiating a notice-and-comment rulemaking, however, the agency notified airport operators of its intention to amend all airport security programs to establish a rule and gave them — but no one else — sixty days to comment. And instead of assuming responsibility to carry out the newly prescribed screening, TSA proposed to require airport operators to conduct most of the physical screening at secured-area entry points. The proposed rule also called on airport operators to develop a plan for acquiring and deploying explosivesdetection equipment within eighteen months of the proposed rule’s effective date.

TSA's proposal , known in the industry as the National Amendment, met a frosty reception among airport operators. Many operators commented that TSA should itself take primary responsibility to screen aviation workers. The Airport Council International-North America (ACI-NA), a trade organization and a petitioner in this case, criticized TSA for imposing a costly requirement on airports that had yet to recover from the impact of the COVID-19 pandemic, argued that the agency lacked statutory authority to do so, and objected to the agency’s decision to forgo the public notice-andcomment procedures contemplated by the Administrative Procedure Act. In all, the agency received comments from 170 airport operators as well as trade organizations like ACI-NA, nearly all of which expressed concerns with TSA’s proposal.

TSA nonetheless finalized the National Amendment in April 2023 with few substantive changes. The National Page 6Amendment clarified that screening could be accomplished through non-contact, technology-based measures. It also explained that airports could rely on screening operations in place before the rule’s effective date if they include an element of randomization, meet the minimum screening requirements, and encompass the covered access points. As with the initial proposal, though, airport operators subject to the National Amendment must themselves conduct the newly required random screening of aviation workers entering secured areas, including searching their person and their “accessible property.” J.A. 670.

In its responses to the comments it received, TSA rejected the suggestion that it — rather than airport operators — should do the screening, explaining that airport security is a 'shared responsibility” between the agency and airports. The agency also sought to justify its decision to forgo the APA’s notice -and-comment procedures and instead proceed through the procedures applicable to an amendment of airport security programs. The agency regulations setting out the latter procedures, TSA explained, allow for approval of amendments to airport security programs after giving affected airport operators an opportunity to comment. Here, TSA had complied with those procedures.

Petitioners include various municipalities that operate airports along with ACI-NA. Each petitioner submitted timely reconsideration requests to TSA pursuant to 49 C.F.R. 1542.105(c)(2) and asked the agency to withdraw the National Amendment. The request submitted by one petitioner, Massport, is illustrative. It requested the agency to withdraw the amendment on multiple grounds, including: that the governing statute gives TSA, not local airport operators, the Page 7duty to screen aviation workers; that the APA required the agency to provide the public with notice and an opportunity to comment before finalizing the rule; and that the rule unlawfully commandeers local officials to implement a federal regulatory scheme.

The agency rejected all the petitions for reconsideration. Among other responses, TSA reiterated its view that it had no duty to undertake a notice-and-comment rulemaking because its own regulations allowed it to amend airport security programs by giving airport operators — rather than the public more broadly — notice and a chance to comment.

Petitioners now seek review of TSA's denial of their petitions for reconsideration. The challengers also moved for a stay of the National Amendment pending our review, which a panel of this court denied.

Petitioners renew all the arguments they previously raised before the agency, including that TSA was required to engage in notice-and-comment rulemaking when promulgating the National Amendment. Because we agree with petitioners on that score, we have no occasion to reach their other challenges to the rule.

At the outset, TSA does not contest petitioners’ standing to pursue that claim. That is understandable, as our precedents demonstrate petitioners' standing to raise their notice -andcomment challenge. See WildEarth Guardians v. Jewell , 738 F.3d 298, 306 (D.C. Cir. 2013); Sugar Cane Growers Coop. of Fla. v. Veneman , 289 F.3d 89, 96 – 97 (D.C. Cir. 2002).

Page 8The APA’s notice -and-comment procedures are set out in 5 U.S.C. § 553(b), and the statute generally assumes that an agency’s exercise of rulemaking must abide by those procedures unless certain exceptions apply. One such exception is for 'interpretative' (or interpretive) rules, as opposed to legislative rules. 5 U.S.C. § 553(b)(4)(A). So in determining whether a rule is subject to the APA’s notice -andcomment provisions, we ordinarily ask whether the rule is a legislative rule (which generally must go through notice-andcomment procedures) or an interpretive rule (which need not).

Legislative rules have the 'force and effect of law,' Encino Motorcars, LLC v. Navarro , 579 U.S. 211, 215 (2016), and usually bring about “ a substantive change in existing law or policy,” Mendoza v. Perez , 754 F.3d 1002, 1021 (D.C. Cir. 2014). Interpretive rules, by contrast, ordinarily lack the force of law and instead only 'advise the public of the agency's construction of the statutes and rules which it administers.' Shalala v. Guernsey Mem'l Hosp ., 514 U.S. 87, 99 (1995) (quotation marks omitted). The statute or rule being interpreted might itself have the force of law, but the interpretive rule merely sets out the agency's view of that preexisting legal obligation rather than establish a legal obligation of its own. An interpretive rule, in other words, “does not itself alter the rights or interests of parties” in the manner of a legislative rule. Chamber of Com. of U.S. v. Dep’t of Lab. , 174 F.3d 206, 211 (D.C. Cir. 1999) (citation and quotation marks omitted).

Judged by those standards, the National Amendment is plainly a legislative rule. The National Amendment's basic objective is to impose new obligations on airport operators by requiring them, among other things, to physically screen aviation workers entering secured airport areas. The rule states that airport operators “must conduct aviation worker screening” and “must” also develop a plan for acquiring and Page 9deploying explosives-detection equipment. J.A. 669, 671. And those newly instituted obligations have the force and effect of law: they are legally binding on airport operators and are subject to enforcement by the agency.

TSA has made that understanding explicit. Soon after adopting the National Amendment, TSA issued a “notice . . . to inform airports and other aviation entities regulated by the Transportation Security Administration' of how the agency would enforce the rule’s requirements upon their taking effect. TSA, Notice of Informed Compliance: Aviation Worker Screening , at 1 (Sept. 6, 2023), J.A. 996. The agency advised that , while 'TSA is not extending or modifying the effective date of the [National Amendment],' it 'is providing a 12 -month period of ‘informed compliance’ for the requirements in' the rule. Id . During that initial period, the agency explained , it “will not pursue civil enforcement action against airports that are making good faith efforts toward implementation of the requirements of the [National Amendment].' Id. But after th at 'informed compliance' period , 'failure to comply with all applicable aviation worker screening requirements will be subject to full enforcement action by TSA.' Id. at 2, J.A. 997.

As that notice makes clear, the National Amendment has the force and effect of law: it imposes new legal requirements on airport operators across the country and those requirements are subject to civil enforcement by the agency. That is a quintessential legislative rule. Indeed, the very fact that the National Amendment has an effective date bespeaks a legislative rule — there would be little reason to set an effective date if the rule merely interpreted a preexisting obligation as opposed to instituting a new one. See Guedes v. ATF , 920 F.3d 1, 18 (D.C. Cir. 2019). After all, TSA adopted the rule precisely because airport workers were not being screened Page 10before entering secured airport areas. The agency promulgated a rule imposing 'new substantive obligations' intended to redress the perceived security gap. Elec. Privacy Info. Ctr. v. Dep’t of Homeland Sec. , 653 F.3d 1, 6 (D.C. Cir. 2011). And in doing so, it 'explicitly invoked its general legislative authority,' Am. Mining Cong. v. Mine Safety & Health Admin ., 995 F.2d 1106, 1109 (D.C. Cir. 1993), citing its general authority to issue regulations, 49 U.S.C. § 114(l)(1), as well as its mandate to provide for the screening of individuals “before entry into a secured area,' id. § 44903(h)(4). See, e.g. , Disposition of Massport Pet. at 2, 5 – 7 (J.A. 881, 884 – 86).

TSA ultimately does not dispute that the National Amendment bears those fundamental characteristics of a legislative rule. Instead, TSA contends it could forgo giving notice and an opportunity to comment to the public because of an agency regulation, 49 C.F.R. § 1542.105(c). That regulation, TSA observes, contemplates that the agency can “amend” an airport operator’s “security program” by “send[ing] to the airport operator a notice . . . of the proposed amendment' and 'fixing a period of not less than 30 days within which the airport operator may submit written' comment. Id. (emphasis added). And here, TSA submits, it provided notice and an opportunity to comment to airport operators in accordance with that regulation, even if it did not provide notice and an opportunity to comment to the broader public.

Even assuming TSA correctly understood and complied with its regulation, an agency’s adherence to its own regulations does not somehow enable it to bypass the APA. The APA's notice-and-comment provisions set out specific exceptions for interpretive rules, rule s concerning “military or foreign affairs,” and rules addressing internal agency management. See 5 U.S.C. §§ 553(a)(1) – (2), (b)(A). The Page 11statute also permits agencies to forgo notice-and-comment procedures if they can establish 'good cause' to believe adherence to the procedures would be “impracticable, unnecessary, or contrary to the public interest.” Id. § 553(b)(B). TSA does not claim to fit within the good-cause — or any other -exception here. What the APA generally does not except from its rulemaking procedures are legislative rules. As to those, an agency cannot simply rulemake its way out of the APA’s requirements for rulemaking.

TSA suggests that public notice and comment would have limited value in these circumstances because the National Amendment principally affects airport operators, not “the public at large, ' and because the agency could (and likely would) refuse to disclose information about its regulatory plans regardless. TSA Br. 68 – 69. The APA, though, does not contemplate an agency's forgoing the statute's notice-andcomment requirements based on the agency’s own assumption that there is a limited need to hear from the public in a given instance. To the contrary, a central object of requiring that the public be afforded notice and an opportunity to comment is to assure that the agency fully understands the potential impact of a proposed rule before finalizing it. Public notice and comment, that is, might alter an agency’s initial assumptions about whether (and how) a proposed rule affects the public at large. See Humane Soc'y of the United States v. Dep't of Agric. , 41 F.4th 564, 568 (D.C. Cir. 2022) (recognizing that notice-andcomment procedures 'foster public participation and facilitate reasoned decisionmaking”).

True, the National Amendment's requirements do not directly affect the general public in the same way as requirements for screening of airline passengers. Cf . Elec. Privacy Info. Ctr ., 653 F.3d at 3. But it would be wrong to say that the National Amendment does not directly affect anyone Page 12other than airport operators. Most obviously, the rule affects the aviation workers who must undergo a physical screening before entering a secured area. Those workers might have provided meaningful input about the proposed rule had TSA given them an opportunity to comment. The APA required affording them that opportunity.

TSA expresses concerns that if it cannot adopt the National Amendment under the procedures for amending an airport security program set out in its regulation, 49 C.F.R. § 1542.105(c), then it may never be able to amend an airport security program pursuant to those procedures. Whatever may be the availability of those procedures in the case of an adjustment to a particular airport's security program, the across-the-board establishment of new, legally binding requirements here — which the agency itself terms a ' National Amendment”— is a legislative rule. Cf. Safari Club Int'l v. Zinke , 878 F.3d 316, 332 – 33 (D.C. Cir. 2017)) (distinguishing adjudications from rules, which typically “announce[] generally applicable legal principles'). Depending on the circumstances, the Agency could also seek to establish good cause for avoiding the APA’s procedural requirements. See 5 U.S.C. § 553(b)(3)(B); Jifry v. FAA , 370 F.3d 1174, 1179 – 80 (D.C. Cir. 2004). But absent that showing, and regardless of the scope of the agency’s latitude to forgo the APA’s notice -and-comment provisions in other contexts, the National Amendment is a legislative rule subject to those provisions.

Having concluded that TSA should have adhered to notice-and-comment procedures in promulgating the National Amendment, we now turn to the remedy. We have previously granted vacatur when an agency adopted a rule without abiding by the APA's notice -and-comment requirements. See, e.g., Page 13Daimler Trucks North Am. LLC v. EPA , 737 F.3d 95, 103 (D.C. Cir. 2013) (explaining that the court 'typically vacates rules when an agency 'entirely fail[s]' to provide notice and comment” (citation omitted)) ; Am. Pub. Gass Ass’n v. Dep’t of Energy , 72 F.4th 1324, 1342 – 43 (D.C. Cir. 2023); Chamber of Com. v. SEC , 443 F.3d 890, 908 (D.C. Cir. 2006); Shell Oil Co. v. EPA , 950 F.2d 741, 765 (D.C. Cir. 1991). But see Sugar Cane Growers , 289 F.3d at 98 (granting remand without vacatur when agency did not adhere to notice-and-comment procedures). We grant the ordinary remedy of vacatur here.

At the same time, TSA adopted the National Amendment based on significant concerns about the risks to aviation security absent the screening requirements established by the rule, and the rule has been in place since it took effect in September 2023. In these circumstances, rather than compel immediate disestablishment of the rule based on the agency’s failure to promulgate it pursuant to the APA's notice -andcomment procedures, we consider it appropriate to withhold issuance of our mandate, see Fed. R. App. P. 41(b), until TSA has an opportunity to adopt a procedurally sound rule (or, in the event the agency no longer considers it necessary to promulgate a rule, to so inform the court). That approach is supported by our precedents. See, e.g., Cboe Futures Exch. v. SEC , 77 F.4th 971, 982 (D.C. Cir. 2023); Chambers of Com. , 443 F.3d at 909 (collecting cases).

Accordingly, our mandate will issue upon the agency's informing the court that it has adopted a final rule consistent with the APA's procedural requirements (or has determined that a rule is no longer needed). In the interim, the agency should submit a periodic status report every 60 days apprising the court of its progress.

Page 14For the foregoing reasons, we grant the petitions for review, vacate the National Amendment, and withhold our mandate under the conditions set out in this opinion.

So ordered.