Continuing threats to the supply chain pose increasing risks to our national security. The new interim Federal Acquisition Regulation (FAR) rule published on August 13, 2019, seeks to address certain of these threats by imposing new representation and reporting requirements on contractors and their subcontractors (herein “contractors”) in the new FAR 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment and the new FAR 52.204-25, Prohibition on Contracting for Certain Telecommunications clause. These new requirements implement Section 889(a)(1)(A) of the National Defense Authorization Act for FY 2019.

The interim rule requires contractors to engage in appropriate due diligence activities in order to accurately represent and disclose whether or not, in the performance of their Government contracts, they procure, use or provide to the Government “any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system.” An affirmative response requires the contractor to provide a report to the Contracting Officer detailing the contract(s) affected and the equipment, systems, or services using such covered telecommunications equipment or services as a substantial or essential component or as critical technology, within 1 business day of making the representation or providing the information.

In addition, the interim rule affirmatively requires the reporting contractor to report on “any readily available information about mitigation actions undertaken or recommended.” The interim rule requires additional reporting within 10 business days, on the “efforts … [the contractor] undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.”

The interim rule allows the Government entity to seek a waiver on a one-time basis with regard to the prohibition on “procuring or obtaining, or extending or renewing a contract” from a contractor that answers in the affirmative. That waiver is only for a limited period and is not to extend beyond August 13, 2021. However, the rule does not guarantee that all such requests will be granted. The requesting Government entity must submit a “compelling justification for the additional time to implement” the prohibition requirements.

The interim rule covers contracts, including those that provide Commercial Items, including Commercial Off-The-Shelf (COTS) items. Under the new rule, Contracting Officers must include the new FAR representation in currently pending and new procurements. In addition, Contracting Officers are required to include the new FAR clause in current contracts, task or delivery orders as part of a contract modification or option exercise.

The new rule raises a number of questions about the intended scope and coverage of the prohibition and the contractor’s requirements to comply, report, and disclose under the rule:

• The interim rule broadly defines which equipment and services are covered by the prohibition and reporting requirements. It states that “covered telecommunications equipment or services” includes (1) telecommunications equipment “produced by Huawei Technologies Company or ZTE Corporation, (or any subsidiary or affiliate of such entities);” (2) video surveillance and telecommunications equipment “produced by Hytera Communications Corporation, Hanzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities;” (3) telecommunications or video surveillance services provided by such entities or using such equipment.” Thus, the rule imposes a duty on the contractor to vet its supply chain to determine whether such equipment or services are being provided or used directly or through another party in the supply chain. Because companies may change names, merge, or operate under alternative business identities, this task may pose considerable risk for the contractor with responsibility to represent, comply, report and take action.
• Additionally, the interim rule defines covered equipment and services to include other as yet unidentified entities — “Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.” “Covered foreign country” is defined as “The People’s Republic of China.” However, the rule does not explain how contractors at any tier will know the names or identities of such entities so that they can ensure their compliance. As a result, the scope of coverage may become a moving target for contractors at all tiers.
• The interim rule applies to the situation where the component, product, or service constitutes “critical technology” or “substantial or essential” components of systems. The definition of “critical technology” refers to multiple regimes, including the United States Munitions List, the Commerce Control List, and the nuclear, biologic and emerging and foundational technologies lists. Given the plethora of possible permutations of what will be considered a covered product, component, or service, a contractor may encounter difficulties in assessing whether an item or service is potentially exempt from coverage. The rule does not define what are considered “substantial or essential” components of systems. Thus, in assessing coverage and compliance, is the test going to be based on dollar value, percentage of cost, functionality, or all of the above? Again, contractors will have to think carefully about coverage issues here.
• The rule also provides certain exceptions. It does not prohibit agencies from procuring or contractors from providing either “A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements,” or “Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.” Presumably these exceptions are intended to cover commercial backbone telecommunications or cloud services. However, it is unclear how contractors that do not focus on telecommunications matters will be able to know for sure whether the services, product, or component is covered by one of these exceptions. Due diligence will be needed. Recent developments involving the security of 5G networks and cloud infrastructure and services raise questions about whether these functions will continue to be permitted as an exception or if this is merely a temporary reprieve to kickstart implementation of these types of restrictions.
• The interim rule requires Contracting Officers to insert the certification and clause in pending procurements, and in new procurements, including those for commercial items and COTS items. It also requires that Contracting Officers insert the clause in current contracts. Contractors should always consider the costs and risks of compliance in preparing bids and proposals, and entering into contracts. Where the clause is to be included in an existing contract, it must be accomplished through a bilateral contract modification. The contractor may want to consider the costs and risks of compliance in negotiation of a bilateral contract modification that addresses those matters.
• Last, and quite significantly, the interim rule requires that contractors flow down the clause to “all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.” Absent a specific definition in the interim rule for these types of arrangements, the contractor must assess which agreements are covered and ensure that it obtains the information it needs for its representations, reporting, compliance, follow-up, as well as flowdown requirements to these entities.

The interim rule is intended to be broad and inclusive. Whether or not it is determined to suffer from such breadth and inclusiveness, contractors and their supply chain should examine their products, equipment, services, and supply chain to determine how to accurately represent, disclose and comply with their requirements. As always, the devil is in the details.

The interim rule was issued on August 13 and permits the public to submit comments within 60 days, by October 12, 2019. If you have questions about the interim rule, or other government contracting matters, contact Susan Warshaw Ebner, or the Stinson counsel with whom you normally work.