Last week, our friends at the Competitive Enterprise Institute won a small but important victory in the effort to bring the Transportation Security Administration under law. It began when the Electronic Privacy Information Center (EPIC) challenged the TSA’s policy of using strip‐​search machines at airports for primary screening. EPIC’s Fourth Amendment attack failed, but the D.C. Circuit Court of Appeals found that the TSA hadn’t used required administrative procedures to establish the policy, and it ordered the agency to promulgate a rule after taking comments from the public.

That was more than four years ago. The agency has been dragging its feet. And last week the court gave TSA thirty days to submit a schedule for “the expeditious issuance of a final rule within a reasonable time.”

Once the TSA has finalized its rule, it will be subject to challenge under the “arbitrary and capricious” standard in federal administrative law. John Mueller, Mark Stewart, and I filed comments during the rulemaking that will help show that the TSA’s policy is incoherent when it’s before the court.

Yes, it’s taking a long time. Courts often defer to agencies as experts in the fields they regulate, though they’re really expert at gaming the regulatory system and the courts. With persistence, though, the effort to bring the TSA under law and reverse its needlessly invasive and expensive programs will bear fruit.

Or responsibility for air security will be restored to airlines and airports.