Fed.Cir.: VA’s IT user inspection rule violates 4A

The VA’s rule-based IT inspection authority for remote access to its databases is overbroad and violates the Fourth Amendment because it includes remote computers and the place where the computers are housed. Military-Veterans Advoc. v. Sec’y of Veterans Affairs, 2025 U.S. App. LEXIS 5214 (Fed. Cir. Mar. 6, 2025):

MVA argues the Inspection Provision exceeds the VA’s statutory authority. We agree. The provision gives the VA the authority to inspect not only the computer hardware and software used to access the VA IT systems, but also the location where the hardware and software are used. As the regulation is written, this could include the user’s home office, entire house, client files, or sensitive personal documents, to name a few examples. The Government agrees that anywhere a user accesses the VA IT systems could be searched, including a user’s bedroom in their home. See Oral Argument at 35:32-50, 38:03-35. This scope is particularly untethered to the statutory authority because the VA is generally an adverse party to the user of the VA IT system. This is a “markedly different” power than Congress likely envisioned in granting the VA the authority to promulgate information security policies. Ala. Ass’n of Realtors v. Dep’t of Health & Hum. Servs., 594 U.S. 758, 764 (2021). VA argues the provision is limited in scope and would not include “rummaging through attorneys’ drawers and cabinets.” Government Br. 61. But the language of the Inspection Provision is not so limited. Whether the VA chooses to utilize the full scope of the Inspection Provision does not bear on our analysis.

The Inspection Provision also exceeds the VA’s statutory authority because it is not based on a risk assessment as required by VA regulations implementing information security policies and procedures. 38 U.S.C. § 5722(b)(2)(a). The VA argues the Inspection Provision is based on the VBMS and Caseflow risk assessments. Government Br. 54-55. But the VA’s citations to the risk assessment do not link any risk to confidentiality to computer hardware and software utilized to obtain access to VA IT systems or their location. S. Appx 2; S. Appx 157.

Even if the VA could demonstrate the Inspection Provision is properly grounded in a risk assessment, given the breadth of the provision, it is not the product of reasoned decision making. …

This entry was posted in Administrative search. Bookmark the permalink.

Comments are closed.