Hacker News Reader

Comment by telotortium | Hacker News Reader

One thing I’ve never heard a good answer to: If Anthropic is a supplier not to the Department of Defense itself, but to Palantir, why isn’t supply chain risk the proper designation (assuming the government’s concerns with Anthropic having authority over military missions is valid)?

As for whether code written with Claude Code should be so considered - if it’s just code that is subject to human review, I would argue that this use shouldn’t be a supply chain risk. But with Claude Code PR Review and similar products, the chance that an AI product (not limiting to Anthropic here) could own a load-bearing part of the lifecycle of a critical piece of code becomes much larger, and deserves scrutiny.

View on HN

> why isn’t supply chain risk the proper designation

Because you can't designate a company a SCR because you don't like the contract you signed with them.

But the DoD signed a contract with Palantir.

to which Anthropic was a subcontractor. government agrees to the entire contract, including the subs

This admin technically can't do a lot of the things it does. They do it anyway with utter contempt for the rule of law. Congress is useless and gives them a blank check and the Supreme Court just stalls everything using the shadow docket.

I'm not sure that "supply chain risk" is even the right term to be discussing.

What Hegseth/Trump want to do is not just stop Anthropic models from being used by any military supplier pursuant to goods/services they are providing to the military, but rather say that if you do business with the military then you must not use Anthropic at all, even if that usage is entirely unrelated to your military contracts.

This is explicitly not what they have done, not how government contractors ever interpret this designation, nor something they could do even if they wanted to do.

It is also common corporate doctrine to use a subsidiary for government contracting to avoid having to evidence that a commercial vendor is utilized for government, so this won't even be 'annoying' for contractors.

ITAR and compliance frameworks (e.g. FedRAMP and CMMC) already mandate this for any non-US company, yet AWS commercial still has offerings in other countries and from non-US vendors, Palantir still has an IG business, etc.

Reply on news.ycombinator.com