I didn't read the news article; I don't have time for sensationalist tripe. Instead, I went straight to the source: http://www.cadc.uscourts.gov/internet/opinions.nsf/0/B310047...

Congress directed the TSA to "give a high priority to developing, testing, improving, and deploying" at airport screening checkpoints a new technology "that detects nonmetallic, chemical, biological, and radiological weapons, and explosives, in all forms." The TSA responded by contracting to develop the scanner in two forms: one that uses millimeter wave technology and another that uses backscatter technology. Each technology is designed to produce a crude image of an unclothed person. No passenger is ever required to submit to an AIT scan, and signs at security checkpoints notify passengers that they may instead opt for a pat down. Each image produced by the scanner passes through filters that obscure facial features and is viewable on a computer screen only bay an officer sitting in a remote and secure room. After the passenger is cleared, the image is deleted.

In April 2010, the EPIC argued that the use of the AIT for primary screening violates the Privacy Act, the Fourth Amendment, a provision of the Homeland Security Act, and the Religious Freedom Restoration Act. Here, the court focused mostly on the procedural argument that the TSA should have engaged in notice-and-comment rulemaking.

The petitioners argued that the TSA refused to process and effectively ignored their 2010 letter that putatively "petitioned" for rulemaking; the TSA claimed that this letter did not "petition for the issuance, amendment, or repeal of the rule," because the relief actually sought was the immediate suspension of the AIT program. This court didn't buy that argument.

The TSA anticipated the court would feel this way, so they next argued that they appropriately responded to the petition by denying it. The court can only set aside the TSA's denial if it is "arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law." Moreover, the court is compelled (by Defenders of Wildlife v. Gutierrez) to give a high level of deference to an agency action under 'arbitrary and capricious' review. Here, the TSA denied the petition on the ground that the TSA is not required to initiate rulemaking procedures each time the agency develops and implements improved passenger screening procedures.

So why didn't there TSA publish notice of a proposed rule in the Federal Register and solicit and consider public comments upon its proposal at the outset? They figured they didn't have to. The 'notice and comments' requirement of the APA does not apply "to interpretive rules, general statements of policy, or rules of agency organization, procedure, or practice." The TSA argued its decision to use the scanners for primary screening comes within all three listed categories. The court notes that procedural rules do not themselves "alter the rights or interests of parties, although it may alter the manner in which the parties present themselves or their viewpoints to the agency. A rule with "substantial impact" upon the persons subject to it is not necessarily a substantive rule, however. The new rule imposes no new "substantive" obligations upon airline passengers: they're still required to pass through a security checkpoint, and they're still prohibited from carrying weapons and explosives on board.

However, the court notes that it is "clear" that producing a picture of an unclothed passenger affects the public in a substantively different manner than the beep from a metal detector, and echoes the policy interests served through notice-and-comment rulemaking. The TSA tried to justify its decision to forego notice-and-comment rulemaking by claiming that it announced only an interpretive rule. The petitioners contended that the rule is legislative, rather than interpretive, because it "effectively amends a prior legislative rule." But, because the TSA's policy substantially changes the experience of airline passengers, it's not merely interpretive. The court notes, however, that the purpose of notice-and-comment rulemaking would be "disserved" if an agency with a broad statutory command (like detecting weapons) could avoid notice-and-comment rulemaking simply by promulgating a comparably broad regulation (like requiring passengers to clear a checkpoint) and then using its power to create a strict and specific set of obligations.

The court held that the "TSA has advanced no justification for having failed to conduct a notice-and-comment rulemaking" and accordingly remanded the matter back to them for further consideration. The reason they decided not to vacate the present rule was because it would "severely disrupt an essential security operation," and the rule is otherwise lawful.

Turning to the substantive claims, the first one (concerning a violation of the VPPA) failed, because it actually requires a rulemaking proceeding to have occurred and for any objection to have first been made there. Of course, that's the same proceeding at issue in this case, so that claim failed. The second substantive claim was that the scanners violate the Privacy Act, but because the TSA doesn't keep any "system of records" linked to names or any other personal identifier. The third claim was actually more viable: it focused on religious opposition to being viewed naked, but that claim failed because none of the litigants have standing to assert a religious injury. Finally, the petitioners argued a Fourth Amendment violation, because the scanners are more invasive than is necessary to detect weapons or explosives. Because this is an administrative search serving a very important social function, the court concluded that there was no violation.