Huawei ban looms for contractors

The deadline for federal contractors to ditch Chinese gear and services in their contracts is a day away and vendors still have more questions than answers.

Federal contractors have until Aug. 13 to comply with Part B of Section 889 of the 2019 National Defense Authorization Act. The provision bans government contractors from using technology and services tied to Chinese equipment manufacturers that have been deemed cybersecurity threats by the U.S. government. Those companies include telecommunications gear-makers Huawei and ZTE, as well as video surveillance manufacturer Hikvision, Hytera Communications Corporation, Dahua Technology Company, as well as their subsidiaries and affiliates.

The provision goes beyond the simple use of the five companies' gear in contractors' networks for federal contracts, extending to its use in any day-to-day operations, including domestic commercial and overseas operations. Companies that have the equipment won't be able to sell to federal agencies after Aug. 13 without a waiver.

"These unprecedented briefings underscore NCSC’s commitment to elevate supply chain security in the federal acquisition process, in keeping with the National Counterintelligence Strategy," NCSC Director William R. Evanina said in a statement. "In partnership with the Office of Director of National Intelligence's National Intelligence Council, we are providing threat information on foreign efforts to subvert the U.S. supply chain and empowering federal procurement and contracting officers who share in the responsibility for protecting the federal supply chain."

Contractors and their representatives are playing catchup when it comes to learning about how the provisions will be put into effect. An interim rule published July 14 for the Federal Acquisition Regulation (FAR), provided initial guidance on how to implement the new rules.

"August 14 will be a busy day," said David Berteau, president and CEO of the Professional Services Council.

The implementation of Section 889 Part B rules, he said, add a layer of additional challenges for agencies and contractors as they work to figure out how to use the guidance in the July interim rules.

The rules appear tough. The guidance mandates "that contractors report (within one business day) any covered telecommunications equipment or services discovered during the course of contract performance." However, there are allowances made for risk levels, and contractors are allowed to self-certify and there's no requirement for a third-party audit.

It isn't clear how federal contracting officers will uniformly implement that judgement when awarding contracts, according to Berteau.

"We didn't know the implementation requirements until the FAR clause in July," he said.

The clause itself also anticipates a ramp-up period for providers and contractors during the first year of the new rule's implementation.

In the first year, "contractors and subcontractors will need to learn about the provision and its requirements as well as develop a compliance plan," said the rule.

"We won't know on the first day which contracts have been delayed because of 889," said Berteau. The processes federal contracting officers will use to determine which products are subject to the ban are not clear, he said, since there is no list of those products, only company names. There also isn't a list of acceptable alternative products. Additionally, according to Berteau, there's no way of knowing what contracting officers look for when they're qualifying a contract.

The impact on federal contractors will vary significantly, said procurement expert Larry Allen. "It depends on what each provider has and whether it is a substantial part of their systems."

Cloud and other service providers, said Allen and Berteau, should have reviews of their systems well underway in any case.

The interim rules, backed by the General Services Administration, the Department of Defense and NASA are not yet permanent. The federal government is taking comments on proposed changes to the rule until September 14 on regulations.gov.

The Department of Defense, said Berteau, has put out the clearest implementation guidelines, but for the most part, civilian federal agency contracting officers haven't received any official training on implementing the rules in judging contract compliance.

Contractors and federal contracting officers work their way through contracts awarded after the deadline, according to Berteau, as contracts in the pipeline before the deadline didn't have the requirements.

GSA is working on a webinar to explain the rules for contractors.

The agency had scheduled the event for Aug. 12, but postponed it until Sept. 10.

"The event, featuring a panel of leaders from GSA's business lines to explain how they are implementing NDAA Section 889 Part B, was moved to allow more time to receive and address specific questions submitted by agency and industry partners," said a GSA spokesman in an Aug. 11 statement to FCW.

This article was updated Aug. 12 to include comment from the National Counterintelligence and Security Center.