Government Reduces Representation Burdens for Supply Chain Rule Banning Some Chinese Equipment 

A new provision easing some of the strain caused by a major supply chain rule banning use of some Chinese equipment took effect last week, but some in the contracting community say more clarity is still needed in order to make implementing the rule doable. 

Section 889(a)(1)(b) of the 2019 National Defense Authorization Act prohibits contractors from using equipment from five Chinese companies including Huawei, ZTE and their subsidiaries or affiliates as part of their work for the federal government. Part B went into effect August 13, and October 26, an addendum to the rule went out changing representation requirements from an offer-by-offer basis to a once-annually recertification process in the System for Awards Management, or SAM.

But inconsistencies in language throughout the life of Section 889 may be adding confusion to what was already a difficult rollout. While there is broad consensus that the intent of 889 is the right move for the federal government, some in industry say the rule is effectively too big to implement. 

Part B of Section 889 drops language that was included in the NDAA, according to comments submitted to the FAR Council by the industry group the Internet Association. While the NDAA language specified “use” meant as part of a “substantial or essential component” or as a “critical technology” in any system, Part B’s representation language doesn’t include these qualifiers. The second sequence of Part B that went into effect Monday does not fix this problem, but instead still lacks the qualifiers.  

The annual representation language asks contractors to say whether they use equipment provided by the covered entities—or their subsidiaries or affiliates—regardless of import or how high in the supply chain the equipment sits. This also applies to any work a contractor performs, not just in products or services provided for the government. 

“The way Section 889 is being implemented, especially with the representation that's being required, it is not allowing for a risk-based approach,” Omid Ghaffari-Tabrizi, IA’s director of cloud policy, told Nextgov. 

In its comments, IA referenced supply chain risk management guidance from the Cybersecurity and Infrastructure Security Agency and the National Institute for Standards and Technology to point out accepted standards suggest organizations should focus on systems and components with the potential to do the most damage if they are compromised instead of the “entire universe of hypothetical risks.” 

“The only way to do this effectively is to take an iterative sort of approach and really break this up,” Ghaffari-Tabrizi said. “Take those substantial and critical components, analyze what's involved in those first, and then build yourself out to what may be directly or indirectly connected to those components and analyze what kind of threats may exist in those.”

The unlimited language adds work on both sides of the procurement table and is out of line with the intent of the provision as it was written in the 2019 NDAA, Ghaffari-Tabrizi added. It is also likely to have a negative impact on competition as smaller contractors struggle to cover costs to enable compliance, he said. IA’s comments suggested reasonable inquiry at this point essentially creates a need for audits, which the government has said would not be required under 889.

“Where does the decision get made about whether an item is in fact included in the definition of critical technology or a substantial or essential component?” Alan Chvotkin, executive vice president at the Professional Services Council, said of the confusion over the language in Part B. 

In its comments on the new representation requirements, PSC lauded the FAR Council for the annual representation component but asked for more clarity around audits. PSC requested the FAR Council put in writing that reasonable inquiry burdens explicitly exclude any requirement to conduct audits. It also wants the reasonable inquiry language to be added to the first Section 889 rule, which took effect in 2019 without the more approachable reasonable inquiry standard. 

Jennifer Bisceglie, chief executive officer at Interos, an artificial intelligence platform that analyzes supply chains, told Nextgov national security risks associated with the covered entities can realistically be stopped by focusing on the top five tiers of the supply chain. Beyond the prime plus the four tiers below the prime, the amount of impact compromised equipment could have is—in most cases—minimized.  

“The challenge is that we want something that industry can actually accomplish,” Bisceglie said. “And right now, there's just no way to accomplish it as it's written.” 

One significant problem contractors face is a lack of information around identifying the subsidiaries and affiliates of the covered entities as well as what commercial products may be connected to the covered entities. 

During a September webinar covering Section 889 implementation, the General Services Administration said it does not provide a comprehensive list of subsidiaries and affiliates. In a frequently asked questions document updated October 23, the U.S. Agency for International Development referred those looking for such a list to the Bureau of Industry and Security within the Commerce Department. 

It is not immediately clear to what list USAID was referring, but a BIS official told Nextgov its Entity List identifies foreign parties that are subject to certain trade regulations. Commenters identified only as persons who implement contracts for USAID in Ethiopia and Kenya asked the government to either come up with its own list or to confirm contractors should be using the BIS Entity List to guide 889 compliance. 

Bisceglie said a supply chain analysis conducted by the Interos platform revealed this subsidiaries and affiliates list may include several hundred entities linked to the five original covered entities. 

But the government is likely hesitant to publish a list for 889 subsidiaries and affiliates because companies that find themselves on the list may see it and change their name or create a new product, Chvotkin said. 

The complications around implementing Part B of 889 have led the Office of the Director of National Intelligence to grant several waivers to agencies including USAID and the Defense and State departments. Waivers for these agencies have been extended through September 2022. 

PSC said in its comments the waiver extensions “[verify] the need for the government to address concerns raised by the contractor community in response to Section 889’s Implementation Rules.”