Dahua, Hikvision, Huawei US Ban Rules Released

The US government has released rules on how the 2018 NDAA ban of Dahua, Hikvision, and Huawei will be implemented when it takes effect in 5 days.

While the release of the rule itself has been widely reported, the actual details within the rules have not. Inside this note, we examine the 44-page rules document, addressing key question such as:

• Why this ruling covers video surveillance products that contain Huawei Hisilicon chips
• How solicitations that are already open or are part of an existing contract are handled
• Why commercial off the shelf products will not be exempted from the ban
• How contractors will need to pledge no banned equipment is provided
• How the limited waiver process works
• How violations will be reported
• What penalties exist for violating these rules

Context

This interim Federal Acquisition Regulation applies to section (a)(1)(A) of Section 889 of the NDAA - there is no rule yet for the 'blacklist' clause, which has been spun off and will be implemented one year from now. It is an 'interim' rule because it has not been published in the Federal Register yet. (CORRECTION: this is not accurate, as the rule is now on the Federal Register, but remains "interim". The "interim" moniker refers to the fact that the rule remains open for minor suggestions for 60 days, see below).

Once in the Federal Register, "interested parties" may submit suggestions for changes within a 60-day period. (Such modifications are typically minor - major changes would need "a supplemental proposed rule", the Federal Register's website states.)

Huawei HiSilicon Included

Products using Huawei HiSilicon chips are covered as section 4.2101 defines the ban to include:

Hisilicon's SOCs ("System on a chip") are an essential component of IP cameras and NVRs that use them as they host the operating system and core code necessary to run the camera. Below is an image example of Hisilicon chips on a Honeywell camera:

This will have a significant impact but should come as no surprise to those following the details. For example, this is consistent with what the Congressional committee which drafted the NDAA told IPVM last December:

“If a company has an end item with Hisillicon chips that they sell to anyone, they will be unable to do business with the federal government.”

Many manufacturers, beyond Dahua and Hikvision, use Huawei Hisilicon chips. For example, China's third-largest manufacturer Uniview generally uses Hisilicon. Many lower-end Hanwha cameras were using Hisilicon but Hanwha is now in the process of phasing them out. Most 'cheap' or inexpensive cameras use Hisilicon, etc. One notable exception is Avigilon who says they do not use any Hisilicon.

We would expect the US Security Industry Association (SIA) to fight this, as many of their manufacturers profit greatly from low-cost Hisilicon chips. However, claiming that SoCs are not 'necessary for the proper function or performance' of a video surveillance device is simply technologically wrong. On the other hand, they have done this before when they successfully campaigned for IP cameras to lose Buy America protection by arguing that 'IP cameras are capable of being employed without using the lens and image sensor'.

COTS Items Included

The rule states that "it is in the best interest of the Government to apply this rule to contracts for theacquisition of COTS items" [commercial off-the-shelf items], citing an "unacceptable level of risk":

Most video surveillance products bought by the US government are 'COTS' in that they are widely commercially available (e.g. Axis, Dahua, Hanwha, Hikvision IP cameras, etc. are widely sold online).

Open Solicitations and Ongoing Contracts

Contractors must include an NDAA notice - which discloses banned equipment - for all "solicitations issued on or after August 13".

Even if the government requested solicitations before the 13th, if the contract is awarded afterwards, the notice must be included:

Even with ongoing contracts, the NDAA notice must be included, barring further procurement of covered products:

Pledge Not Supplying Banned Items

In their NDAA notices, contractors must pledge not to supply covered equipment:

Note: while the line above says 'telecommunication', the FAR itself defines video surveillance as part of 'covered telecommunications equipment' (see excerpt image).

If they are including covered equipment, contractors must report it to the contracting officer or, for DoD contracts, directly to the DoD website:

Contractors must also disclose key details about the covered equipment, including whether "the entity was the OEM or a distributor":

Waivers

Waivers allowing contractors to supply covered equipment are obtainable "on a one-time basis" from "[federal] agency heads".

However, these waivers can only be granted if there is a "compelling justification for the additional time [necessary] to implement" the NDAA ban and the contractor submits a "phase-out plan":

The only other way to get a waiver is if the Director of National Intelligence "determines the waiver is in the national security interests of the United States".

Penalties

Generally, violating Federal Acquisition Regulations carries consequences such as "cancel[ing] the procurement" and "disqualify[ing] an offeror"; serious violations can even be referred to "appropriate criminal investigative agencies."