US DoD Declares "Can No Longer Do Business" With Contractors Using Dahua, Hikvision, Huawei

The US Department of Defense has confirmed to IPVM that they fully support and intend to proceed with the NDAA 'blacklist clause' covering Dahua, Hikvision, and Huawei video surveillance.

DoD: "We Can No Longer Do Business" With Companies Using Banned Products

On March 26, speaking at virtual conference GovCon, the Chief Information Security Officer (CISO) for DoD Acquisitions, Katie Arrington, stated:

in August of 2020, if any of our contractors in the Department of Defense or our industrial base have Huawei, ZTE, or Hikvision video surveillance cameras, or telecoms, we can no longer do business. [emphasis added]

This extends the government's actions much farther. The first year of NDAA action simply prohibited the US federal government from buying or using banned products. Now, the second year (starting in August 2020) extends that ban to anyone who wants to do business with the federal government.

The video, in which Arrington also emphasizes bringing the supply chain home, is embedded below:

Arrington Background

Arrington is the top cybersecurity official for DoD's vast acquisition department, serving "as the central hub and integrator within the Office of the Under Secretary of Defense for Acquisition and Sustainment, OUSD(A&S), to align acquisition cyber strategy" per her conference bio.

DoD Response: Dahua Users, Substantial Components Included

DoD spokesperson, Lt Col Mike Andrews, confirmed to IPVM that Arrington's comments included Dahua as well, noting: "her comments applied to each company covered by the statute (section 889)."

The DoD also confirmed that products containing Huawei as an 'essential component' would also be included in this move:

As written, the statute prohibits procurement of any equipment, system, or service that uses covered equipment (i.e., equipment or services that incorporate Huawei et al. components) “as a substantial or essential component of any system or as critical technology as part of any system”, unless an exception applies or a waiver is granted. [emphasis added]

As IPVM has covered, there is no doubt that a HiSilicon system-on-a-chip counts as a "substantial or essential component", with a House Committee spokesman previously stating:

If a company has an end item with HiSillicon chips that they sell to anyone, they will be unable to do business with the federal government.

Remarks Show Government Is Serious About Blacklist

IPVM has been closely watching the implementation of the NDAA ban's 'blacklist clause', technically called (a)(1)(B) of Section 889.

This clause has caused significant concern due to fears that it will blacklist every Hikvision, Dahua, and Huawei HiSilicon chip user from selling to the US government. These users have hoped that the Trump administration would water down the rule as actual implementation details are drafted.

However, Arrington's comments are the latest proof that the federal government intends to apply the law thoroughly and as it was originally intended. (See IPVM's first report on this issue: Sell Dahua or Hikvision At All, Banned From Selling to US Federal Government). Last month, the White House also indicated it would use a "broad interpretation" of the blacklist clause.

Coronavirus Means Higher China Supply Chain Scrutiny

While the coronavirus crisis could lead to a delay in the blacklist clause's implementation, it is also sparking intense US scrutiny on China supply chains, with Arrington stating:

If COVID-19 has shown us anything, getting our own supply chain, making sure that we are taking care of home first is crucially important to our national defense

Meanwhile, the coronavirus is renewing US-China tensions, with the PRC accusing the US military of releasing the virus. These factors certainly do not favor a softer US approach.

Key Details Remain Unknown

Nevertheless, key details remain unknown about the blacklist clause, including how the federal government will interpret the NDAA language which bans someone who "uses" covered equipment, i.e. is an integrator who once installed Hikvision cameras in a bowling alley considered a 'user'?

IPVM expects more clarity on this issue in the coming months. These details are still being discussed, with a government meeting being held on the topic on March 2. Currently, the latest update is that a (non-public) draft of the clause is under review at the Office of Information and Regulatory Affairs (OFPP) in the White House's Office of Management and Budget (OMB).

DoD No Comment on Further Details

DoD told IPVM it could not give further comment on blacklist implementation details as the Federal Acquisition Regulation is still being written:

A FAR case implementing the prohibitions of 889(a)(1)(B) [the blacklist clause] is also in process, which will further impact DoD procurement. When a FAR rule is published, it will include additional information about interpretation of the statute, and the public will have an opportunity to provide comments. We [are] unable to further discuss any pre-decisional information regarding interpretation of 889(a)(1)(B) until a FAR rule is published.

SIA No Response

The US Security Industry Association, who represents Dahua, Hikvision and many of their US partners did not respond to our requests for comment on the DoD's statements to IPVM.

SIA has pushed against a tough interpretation; e.g., at a March 2 meeting, SIA gave a presentation warning of "vague language" and "a significant negative economic impact".

Conclusion

It's clear the US government is taking a firm approach towards Hikvision/Dahua integrators or those using equipment with Huawei HiSilicon chips. Any integrators who find themselves in this category should pay close attention if they want to do business with the federal government again.