US GSA Explains NDAA 889 Part B Blacklisting

By Charles Rollet, Published Jul 31, 2020, 09:48am EDT

With the 'Blacklist Clause' going into effect August 13 that bans the US government from doing business with anyone who "uses" Hikvision/Dahua/Huawei HiSilicon equipment and services, the GSA has now provided detailed answers.

IPVM Image

During the webinar, GSA addressed topics many integrators have been asking about, such as whether selling banned items is considered "use", whether a single employee using a banned item at home counts, how easy it is to get a waiver, the status of pre-installed equipment, and more.

Overall, the GSA's responses indicate the government intends a broad and thoroughly-implemented ban with little evidence of major loopholes/compromises with industry.

In this post, we summarize the GSA's responses on the following topics:

  • Does Selling Count as "Use"?
  • Distributors Status?
  • Enforcement Mechanism For Blacklist Clause
  • GSA on Waivers: "Very High Bar", "Very Narrow", "Hurdles Quite High"
  • Some Waivers Effectively Delayed Implementation, Not Really Waivers
  • Blacklist Clause Applies to All Federal Contractors, Even Shovel Providers
  • "You Have to Include" Equipment from Subcontractors
  • What About An Employee Using a Huawei Cellphone?
  • Leased Equipment "Not Absolved"
  • Foreign Branches Not Exempt
  • One Day To Report If Banned Equipment Discovered Post-Award
  • "Doesn't Matter" How Old Equipment Is
  • What About Completed Contracts?
  • GSA On Avoiding Component Risk: "You Have to Conduct A Reasonable Inquiry"
  • Additional Companies May Be Added
  • Examples of Non-Covered Equipment

Plus, we include the full audio recording and transcript so you can easily scan the exact language the GSA used.

Complete ***** ********* / **********

Does ******* ***** ** "***"? *** **** "*******"

*** *** *** ********** asked ******* ******* ****** equipment ****** ** "***" and **** ***** ** blacklisting. ** **** *** explained,*** *** ***** ** not ******* ****, ******** **** ** state **** "***********" ** banned ********* ** **********.

*** **** *** ****** on ******* ** "*******" and ********* ****** ********* submit * ******* ***** this ** *** ******* Register ** ***********.***. (*** deadline *** **** ** September **).

**** *** ******* ******* and ** ********* ********* to ******* ********?Again, "***" ** *** *******, ** **'* *******. I think that's a good question to include in your comments to the Federal Register to the FAR rule.

Distributors ********?

*******, ** *** *******, GSA ****** ** *** OK ** * ********** simply *** * "*** of ****** *******" ** the ****** *** ****'* using **:

* *******you ***** **** * *** ** ****** ******* ** **** ****** if you wanted to. I don't even sure if they make routers. I'm not trying to pick on a specific company, but you could have a box of prohibited equipment in your office. But *** ***'* *** **. If you use it, it doesn't matter why you're using it, we mentioned use is any use.

**** ***** ** ** indication **** *********/******/***** ************ may *** ** *********** (as **** ** ** "maintenance" ** ********). ** be ****, *******, ***** is * ********** ******* a *** ** ****** equipment ***** ****** ** an ****** *** ******** selling **** *********. ** expect **** ******* **** the ***** **** ** issued.

No ******** *********** ********* *** ********* ******

*** **** **** ** someone ******** *** ****, there ** ** ******** enforcement ********* ** *** blacklist ******:

*****'* ** ********** *********** that's ******** ** ******* 899 [...] ** **** follows *** ****** *********** for ********** **** ***** government *********.

GSA ** *******: "**** **** ***", "**** ******", "******* ***** ****"

** ** *********** ******** to "***" ****** *********/******** if * ****** ** obtained, *******,** **** *** ********, ******* *** ** very *********, ********* *** GSA ********** ************:

******* *** ** *** NDAA *** ** *** FAR **** **** ***** some *******. *******, *** waivers ***very ******, and that, again, is to address the threats. These threats are real, and we need to protect the American government's supply chain.

*** ******** ** ******** Intelligence *** ***** ******* 899 **** *, **** B **** *** ******** security *********.Clearly, ****'* * **** **** ***.

*** *** *** ***the ******* *** ***** ****. A lot needs to be done before a waiver can be granted. [emphasis added]

Some ******* *********** ******* **************, *** ****** *******

*** ***** **** ***** are *** ***** ** waivers: ***** ****** ******** by *** ******** ** National ************ *** ***** issued ** ******* ****** heads. *******, *** **** the ****** *** ********* "delayed **************" ****** **** waivers:

****'**really ******* **************, and [here's] why I prefer to call them that than waivers. So per the statute, agency heads may, on a one-time basis for each contractor, delay the effective Section 889 Part A through August 13, 2021. Similarly, they may - on a one-time basis for each contractor - delay the effect of Section 889 Part B [blacklist clause] through August 13, 2022. So first, you can see right there, it's not really a waiver because there's an ending date

Blacklist ****** ******* ** *** ******* ***********, **** ****** *********

*** ******** **** *** blacklist ****** ******* ** any ***** ********** ** the ** **********, ******* exception, **** *** **** provides *******:

*****, *** **** ** determine **** ** *****. So ** * ********, Section *** **** * is ***** *** ******** and *** ** ****************** equipment ** ********, ** matter *** ******** ******.If *** *** ** ** ******* ******* ** *** ********** ** *****'* ******, we still need to know whether you use prohibited telecom.

"You **** ** *******" ********* **** ************** ** ***************

*** *************** ************ "** not **** **** ** subcontractors", *** *****, ******* only *** ***** ********** is ******** ** **** a ************** ** *** government, *** **************. *******, as **** ** **** representation, *** ***** ********** must ******* *** ******* use, ********* *** ********* provided ** **************:

** *** ************** **** not **** **** ** subcontractors. *** ** *** are ***** * ***** of ********** **** ** provided ** *** - your ******* - ** another *******, *** *** within **** ********** ******* have *********** ** ** whether ** *** **** is ********** *******,you **** ** ******* ****, *** **** ** ******* **** ** **** **************. So the representation doesn't flow down to subcontractors, but your representation does cover or does include all instances of your use of telecom across your entire company.

What ***** ** ******** ***** * ****** *********?

*** *** ********** ***** whether * ******* ****** a ******** ****** ********* would **** *** ******** "uses" ******* ******* *****/******** and ***** **** ** blacklisted. *** ********* **** it ******* ******* *** phone ** ***** **** for ******* ********:

** ** **** ********'* Huawei ********* ** ***** used ** **** *******, then **** ************** ******** that *** *** ******* telecom *** *** ****** device [...] *** **** to ****** ***whether ****** ***** **** ** ** ******** ** **** ** ********** *** ** *** *******.

** **** *****, * Hikvision ****** ***** **** by * **********'* ******** for ****** ******** ********, i.e. ** ***** *** dog ** ****, *** not ** ********** ******* "use". *******, *******, **** would *** ** *** case *** * ********* camera ***** **** ** monitor ** **********'* ******.

******Equipment "*** ********"

*** ****** **** **** checking ***'* *********, *********** have ** ******** *** usage, **** ** *** equipment ** *** *********** owned ** *** **********:

** ** ***'** ******* a ***** ** *********, or ** ***'** ******* a ******* ******** ** you ** ******* *******, thatdoes *** ******* your company's need to provide information about it if that information is already in your company's possession.

*** ***** **** ** a ********** **** * WiFi ******* ** ** office, **** **** ** check ******* **'* ***** provided ** * ****** telecom:

** *** *******, ** the ******** ***** ******** has **** ******** ** the ******** ********** *******, and *** ******** ** being **** ** *** contractor - *** ***** contractor *** *** **********'* purposes - **** ****'* used ** *** ***** contractor, *** ** *** need ** ******* * reasonable ******* **** **** 'use' ** ********* ******* that ******** ******** *** prohibited ********* ** ********.

Foreign ******** *** ******

*** *** ********** ***** whether ****** ********* *** by ******* ******** ** a ********** ****** *** confirmed **** ** ** the ****:

** **** ** ****** in *** ****** ******* where * ******** *** of ***** **** *********' equipment ** ****. ** we **** ** **** that **** *************?***,** **** ****** ** part ** *** **** entity, **** ****** ** part ** *** ***** contractor,'use' ** **** ****** ** ********** '***' **** *** **** ** ********* about.

**** ******* **** ** there ** ** ****** but ** *** **** equipment ** *** ******* country:

**** ***** ********** ***** the ********** ** ******* in * ******* **** as ********, ***** *** monopoly ******** ********, *** government ** ******** **** covered ******* *** ***** infrastructure? ****, ** **** contractor **** **** ******** infrastructure, ****'* *** *** of ******* *******. *** if *** **** ***** it, ** **** ********** inquiry ***** ** **** information,you **** ** ********* ** *** ********** **** *** *** ******* *******.

One *** ** ****** ** ****** ********* ********** ****-*****

*** *** ****** **** "post-award", ** * ********** belatedly ********* ****** ********* usage, ** *** ******* one *** ** ****** this ** *** **********, and **** ** **** to ******-** **** * report ** "**********" ** the *****:

**** ******* ****-***** ** it's **** ********** **** violated ******* ***? ******* question. ********* ****** **-***-** requires *********** ** ****** to *** *********** ******* if **** ******** **** covered ******* ********* ** services **** **** ****** contract ***********, *** **** have *** *** ** do **.Within *** ***, *** **** ****** ** *** ******** *******. And then within 10 days, you need to provide a supplemental report which talks about the mitigation of that use.

"Doesn't ******" *** *** ********* **

*** **** **** *** banned ********* ********* ** the **** ***** ***** used ** *** ********** must ** ********, ********* in * *** ** getting ********** *********.

**** ** ********* ** or *** **** ********* previous ** **** ******? Does **** ***** ***** as ******* ** ** reportable?Yes, ******** **** ****** **** ****** ** **********. Doesn't matter who provides it, doesn't ****** **** ** *** ******, doesn't matter how old it is, if you use it, it can't be prohibited, if you want to get a new government contract.

What ***** ********* *********?

*** *** ***** ******* a ********** *** **** installed ****** ********* *** the ********** ** *** past ***** ** ***********; GSA ********* **** **, unless *** ********** ** "still *****" *** *********:

** ** *** *** an ***** ******* ******** with *** ********** ****'* now ********* *** *** provided ******* ******* ** us - *oesn't ****** ******* **** *********** ** **** ******** **** *****. If this means, what if you had an older contract to provide something to your company, and you're ***** ***** **? Well, then that's part of your representation now. Doesn't matter when you bought this stuff, if you're using it, and it's prohibited, when you have to represent that way to the government. But if it's something that you just said to the government, that's fine. If it's a completed contract.

GSA ** ******** ********* ****: "*** **** ** ******* * ********** *******"

*** ************ *** **** of ********** **** ** prohibited ********* ****** ** in * **********'* ****** chain. *******, ***** *** no ********** ** ********* for **********. **** **** must ** ********* ** the ******** "********** *******", GSA ****:

** ***** * **** of ********** ** *** components **** *** ********** companies ****** ** ** equipment ******** **** ** improvement ** *******? ***, absolutely. *** ****'* ***** the ********** ******* ***** in.You **** ** ******* * ********** ******* to ensure that any piece of equipment or any service that your company uses does not include any covered components. [emphasis added]

*******, ** ***** ** required, ** *** *** clarified:

* ********** *******, ***** is ** ******* ******** to ******* *** *********** in *** ******'* **********, about *** ******** ** the ******** ** ******** a ********** ******* **** by *** ******, *** there'sno **** *** ** ******** ** *****-***** ***** [emphasis added]

Additional ********* *** ** *****

*** ****** **** "********** companies *** ** *****" to *** **** ***, however, **** ** ** to *** ********* ** Defense *** ** ** unknown ******* **** **** happen *** ***** ***** may ** *****:

***** *** *** ***** is *** ********** **** updated? *** **** ** in *** *******. *** that's **. ********** ********* may ** *****, **'* unclear *** *** ***** that's ***** ** ** done, ****** **** ** will ** **** *** the ********* ** *******. To *** *********, ** additional ********* **** *** been *****, *** **'* possible **** **** ****.

Examples ** ***-******* *********: ******** ******

*** ********* ** *** blacklist ****** ** ********* which "****** ***** ** redirect" **** ****; *** GSA **** * *** examples, ********* *******:

******** ******** ******* ******** providing ********* ***** **** services *** ************* *****. Electrical *** **************,cabling *** ****** ****** ******** ****** ******* ************, I'm not sure if that's helpful, but those are the answers that we've come up with for examples of equipment that cannot route or redirect user data traffic.

Comments (20)

**** *** *** ********* to ****** * ****** clearer!

Agree: 3
Disagree
Informative
Unhelpful
Funny

**** ** ******* ****. In ***** ***** ***** the **** ******* **** busted ****'* ***** ***** their ********* ** **** subject ******. "****** **** don't **** **** **** are ******* ***** ** they *** ********* ***** information."

** ** ****'* *** IPVM ***** ***** *** diligence ** *** **** most ** ** ***** know **** ****** ***** the ****. ***** ** IPVM *** ***** ************ and ********** ** **** us ********, **** ** it ***** **** *** government *** *** **** squeeze ** **** *********** out ** * **** still ******* ** ******** cloudy ***** *** ****. Not ****'* ***** *** the *********** ********* **** dribble ** ***** ***** the ****.

Agree: 12
Disagree
Informative: 1
Unhelpful
Funny

*** ****** ****** ******** in *** ******* ** known *********** ******** ************** should ** *********** ****** IPVM ******* *** ******** so *** ******* *** aware **** *** ***** may ******* ***** **** are ** ***-**********. *********** to ******* ********, ********, firmware, ******* ** ******, corporate ************ *** ** known ************. **** ****** happen ******** ***. **, 2020 ** ******. ** is * ****** ******** to **** ***** *** brands ** ******** ***** what ** **** *** why.

Agree
Disagree
Informative
Unhelpful
Funny

"**** ******* **** ** there ** ** ****** but ** *** **** equipment ** *** ******* country:

**** ***** ********** ***** the ********** ** ******* in * ******* **** as ********, ***** *** monopoly ******** ********, *** government ** ******** **** covered ******* *** ***** infrastructure? ****, ** **** contractor **** **** ******** infrastructure, ****'* *** *** of ******* *******. *** if *** **** ***** it, ** **** ********** inquiry ***** ** **** information,you **** ** ********* ** *** ********** **** *** *** ******* *******."

** **** ***** *********** traveling ******* ********* *** are ******* **** ***** mobile *****.

** *** ******** **** at **** ***** *** might **** **** ********* to ****** **** *****?

**** ****** ********** ** abide ** *** *******, unless **** ******** **** scenario ** *** **********.

Agree
Disagree
Informative
Unhelpful
Funny

**** ********. ****** *** webinar (**:**), *** ********* "voice **** *** ************* calls" ** *** ******* of ** ******** ******* along **** ****** **** cabling:

******** ******** ******* ******** providing ********* ***** **** services *** ************* *****. Electrical *** **************, ******* and ****** ****** ******** cables ******* ************, *'* not **** ** ****'* helpful, *** ***** *** the ******* **** **'** come ** **** *** examples ** ********* **** cannot ***** ** ******** user **** *******.

Agree
Disagree
Informative: 1
Unhelpful
Funny

** **** *****, * Hikvision ****** ***** **** by * **********'* ******** for ****** ******** ********, i.e. ** ***** *** dog ** ****, *** not ** ********** ******* "use".

**** ** *** ******** has * ***** ** maintenance ******** *** *** system **** *** ********, which ***** ********* *********?

Agree
Disagree
Informative
Unhelpful
Funny

****** *** *** ********! If *** ******** ** involved ** "***********" ** a ****** ****, **** must ** ******** ** the ************** ** ** is ********** * ********** "service". ******* **** *********** is *** ** **** owned ** ** ******** or ******* **** *****'* really ******. ** ****** a *** **** **** the *********** ***** ** our ******** ******* ***** ********: *** Dahua ** *********, ** US ********** *********

Agree: 1
Disagree
Informative
Unhelpful
Funny

* ***** **** ** the ****** **** *** going ** **** ** a *** ** ********* and *********** *** ***** to ** *** ****** "use" ***** **** **** routers, ******* ********, ***** infrastructure, ***** ****** ***. not ** ******* *** the **** ***** ******* that *** ********* ***** but *** **** ****** that *** **% ** their ******* **** **** their *** *****. ** you ***** ***** ** double *****.

Agree: 2
Disagree
Informative
Unhelpful
Funny

*** ********* ** *** blacklist ****** ** ********* which "****** ***** ** redirect" **** ****; *** GSA **** * *** examples, ********* *******:

*** ** *** ***’* use * ********* ****** because ********* **** ********* internally, *** *** *** use ********* *****?

Agree
Disagree
Informative
Unhelpful
Funny

*** ********* ****** **** affects ***** *********** *** their *** ** ******* services/equipment; ** **** *** "flow ****". ** *** are * ***** ********** using ********* ******** ****** or ********* *******, **** is **, ******* ***** are *** ******* ********/*********.

Agree
Disagree
Informative
Unhelpful
Funny

*** *** **** ******* prime *********** *** ***** use ** ******* ********/*********; it **** *** "**** down".

**, **** ***** *****, thx.

****** **** * ****** you ***** ***** **** the ********** ***** *** buy ********* *****/******* ******** from *** ************.

***** ** ***** * bit *** ******* **’* the **** ******* ******* direct ** **** ** integrator.; ***** **** * middleman *******’* ** ****** to ******** **.

Agree
Disagree
Informative
Unhelpful
Funny

*******, ********* (*********) **** Hikvision *********/******** *** ***** definitely *** ** ******* to ** * ***** contractor ** *** ******* government ** *** ********, even **** ** **** shovels ** *** ***** Guard.

***** ** ***** * bit *** ******* **’* the **** ******* ******* direct ** **** ** integrator.; ***** **** * middleman *******’* ** ****** to ******** **.

* ********** *** **** point, *** * ***** the ******** ********* ** so ***** - *******, etc - **** *** impact ** ****** *******.

Agree
Disagree
Informative
Unhelpful
Funny

*** ******* ** ** employee ****** & ***** a ****** ***** *** personal *** ** **, but **** ** *** contractor ***** **** ****** to **** ******** & they *** ****** ** the **** ********* ****** phone?

Agree
Disagree
Informative
Unhelpful
Funny

**, **** ********. ******** GSA *** *** ***** of **** ****** ************, I ***** **'* ***** clear **** *******/******* **** emails ** "*** ** the *******". ********, *** said:

*** **** ** ****** out ******* ****** ***** used ** ** ******** at **** ** ********** use ** *** *******.

** ***** ** **** to ***** **** ******* work ****** ** **** is ******* *** ******* use. ************ ** **** moment **** **** ********* are ******* **** ****.

********, *** **** ***** of *** ********* ****** is ** ****** ** contractors **** *** **** secure ******** ****** ******/******* networks, ******* **** *********** have **** ******** ** foreign *********** ** *** past *.*.********** ****: ***** ****** a **** ********** *** secured * ***** ** highly ********* **** ** submarine *******

Agree: 1
Disagree
Informative
Unhelpful
Funny

**** ** *** *** confusing. ***'* *** ** as *** ********** **** a ****** **** * banned **** ** ** to * ******* **** has * ******** **** the ******* ********** ** provide * ******* ** the ******* **********. ** the ********** ** ** not **** * ******** to *** ******* ********** and ** *** *** selling ******** ** *** federal **********. *** ****** we **** ** *** being ****** ** *** federal ********** ******. ***** this **** ***** **** ban? ** **, ** we **** ** ** back ** *** ** our ******* **'** **** cameras *** *** *** them **** ***** ******* contracts *** ** ******** due ** ********* ** installed ** **** *****? As ** *** **** it's *** **** *** and ***** **** *** banned **** **'* ********* of ****** ***** ******* and **'* **** ********* to **** ***** **** have ****** ***** *** which **** ** ***.

Agree
Disagree
Informative
Unhelpful
Funny

**'* **** ********* ** know ***** **** **** banned ***** *** ***** ones ** ***.

** *** ******* ******** an **** ********* ** be ******** **** ****, fyi.

Agree
Disagree
Informative: 3
Unhelpful
Funny

***'* *** ** ** the ********** **** * camera **** * ****** chip ** ** ** a ******* **** *** a ******** **** *** federal ********** ** ******* a ******* ** *** federal **********. ** *** integrator ** ** *** have * ******** ** the ******* ********** *** we *** *** ******* anything ** *** ******* government. *** ****** ** sold ** *** ***** resold ** *** ******* government ******. ***** **** fall ***** **** ***?

** **** ******* ********** contractor ** ********* ***** using **** ****** *******, then ***, ******** ****** 13, **** **** ***** blacklisted (****** **** ****** the ******* ****.)

** **, ** ** need ** ** **** to *** ** *** clients **'** **** ******* too *** *** **** know ***** ******* ********* may ** ******** *** to ********* ** ********* at **** *****?

***********, **'* ** ** the ***** ********** ** conduct * "********** *******" into ***** *** ********* banned ********* ***. ** the ***** ********** ** still ***** *** ****** equipment, *** **** ***'* realize **, *** *** don't ****** ****, **** risk ***** *********** ******** August **.

Agree
Disagree
Informative
Unhelpful
Funny

** ** *****, ** the ***** ********** ********* banned *********/******** ***** ***** August ** **** ** was *** ***** **, it ** *** *********** blacklisted - ** ** wrote ** *** ****, the *** ****** **** such * ********** *** exactly *** ******** *** to ****** **** ** the ********** *** **** 10 **** ** ******-** with * ****** ** "mitigation" ** *** *****:

**** ******* ****-***** ** it's **** ********** **** violated ******* ***? ******* question. ********* ****** **-***-** requires *********** ** ****** to *** *********** ******* if **** ******** **** covered ******* ********* ** services **** **** ****** contract ***********, *** **** have *** *** ** do **.Within *** ***, *** **** ****** ** *** ******** *******.And then within 10 days, you need to provide a supplemental report which talks about the mitigation of that use.

**** **** *****!

Agree
Disagree
Informative
Unhelpful
Funny

* **** *** ****** say, **, ** *** prime ********** **** *** sell *** * *** does **** **** ** OK *** *** *****, WRONG.

**** ** ***** **** is **** *** ***** must ****** **** **** are *** ******** ***** products ( **** **** subs) *** ** **** don't ** ***** *** and *** ******, **** they **** **** *** on ********** *********. ** they **** *** ***** sub ****, **** **** a *** ** *** info **** *** **** find *** ********** ***** could ** ****** , new ********, ************, ***….

***** ** ** **** way, ******** ******* *** close ** $*** **** year.

******** **** ***** ** new ****** *** **** slots ** ****** **** do *** **** ***** products **** **** ******* then **** ***** **** their ******* ******.

**** ***** * $*** company ** * *** but **** **** ******** all ***** ** ****, $25K ** >

***** ******** ** ***** in *** *****, **** a *** ****** *** rules, **** **** **** pass ** **** ********** government *****, **** **** have *** **** ******** within ** ****** ** gov *****. **** **** happen ** **** *** death ***** *****

Agree: 1
Disagree
Informative
Unhelpful
Funny

****** **** ***** ** some **** ******* **** privacy ****, *** *** prime *********** **** *** GSA **** **** ** replace *** ******* *** internal *******.

*****.

Agree
Disagree
Informative
Unhelpful
Funny
Read this IPVM report for free.

This article is part of IPVM's 7,032 reports, 935 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now
Loading Related Reports