B08 - ENCLOSURE 1 - FAR Case 2019-009.pdf

[Federal Register Volume 85, Number 135 (Tuesday, July 14, 2020)] [Rules and Regulations] [Pages 42665-42679] From the Federal Register Online via the Government Publishing Office [www.gpo.gov] [FR Doc No: 2020-15293]

[[Page 42665]]

DEPARTMENT OF DEFENSE

GENERAL SERVICES ADMINISTRATION

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

48 CFR Parts 1, 4, 13, 39, and 52

[FAC 2020-08; FAR Case 2019-009; Docket No. FAR-2019-0009, Sequence No.

1]

RIN 9000-AN92

Federal Acquisition Regulation: Prohibition on Contracting With Entities Using Certain Telecommunications and Video Surveillance Services or Equipment

AGENCY: Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA).

ACTION: Interim rule.

SUMMARY: DoD, GSA, and NASA are amending the Federal Acquisition Regulation (FAR) to implement section 889(a)(1)(B) of the John S.

McCain National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2019 (Pub. L. 115-232).

DATES:

Effective: August 13, 2020.

Applicability: Contracting officers shall include the provision at FAR 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment and clause at FAR 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment as prescribed-- In solicitations issued on or after August 13, 2020, and resultant contracts; and In solicitations issued before August 13, 2020, provided award of the resulting contract(s) occurs on or after August 13, 2020.

Contracting officers shall modify, in accordance with FAR 1.108(d), existing indefinite delivery contracts to include the FAR clause for future orders, prior to placing any future orders.

If exercising an option or modifying an existing contract or task or delivery order to extend the period of performance, contracting officers shall include the clause. When exercising an option, agencies should consider modifying the existing contract to add the clause in a sufficient amount of time to both provide notice for exercising the option and to provide contractors with adequate time to comply with the clause.

The contracting officer shall include the provision at 52.204-24, Page 1 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020)

7/20/2020https://www.govinfo.gov/content/pkg/FR-2020-07-14/html/2020-15293.htm

Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment, in all solicitations for an order, or notices of intent to place an order, including those issued before the effective date of this rule, under an existing indefinite delivery contract.

Comment date: Interested parties should submit written comments to the Regulatory Secretariat Division at one of the addresses shown below on or before September 14, 2020 to be considered in the formation of the final rule.

ADDRESSES: Submit comments in response to FAR Case 2019-009 via the Federal eRulemaking portal at Regulations.gov by searching for ``FAR Case 2019-009''. Select the link ``Comment Now'' that corresponds with FAR Case 2019-009. Follow the instructions provided at the ``Comment Now'' screen. Please include your name, company name (if any), and ``FAR Case 2019-009'' on your attached document. If your comment cannot be submitted using https://www.regulations.gov, call or email the points of contact in the FOR FURTHER INFORMATION CONTACT section of this document for alternate instructions.

Instructions: Please submit comments only and cite FAR Case 2019- 009, in all correspondence related to this case. Comments received generally will be posted without change to http://www.regulations.gov, including any personal and/or business confidential information provided. To confirm receipt of your comment(s), please check www.regulations.gov, approximately two to three days after submission to verify posting.

All filers using the portal should use the name of the person or entity submitting comments as the name of their files, in accordance with the instructions below. Anyone submitting business confidential information should clearly identify the business confidential portion at the time of submission, file a statement justifying nondisclosure and referencing the specific legal authority claimed, and provide a non-confidential version of the submission.

Any business confidential information should be in an uploaded file that has a file name beginning with the characters ``BC.'' Any page containing business confidential information must be clearly marked ``BUSINESS CONFIDENTIAL'' on the top of that page. The corresponding non-confidential version of those comments must be clearly marked ``PUBLIC.'' The file name of the non-confidential version should begin with the character ``P.'' The ``BC'' and ``P'' should be followed by the name of the person or entity submitting the comments or rebuttal comments. All filers should name their files using the name of the person or entity submitting the comments. Any submissions with file names that do not begin with a ``BC'' or ``P'' will be assumed to be public and will be made publicly available through http://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: Farpolicy@gsa.gov or call 202-969- 4075. Please cite ``FAR Case 2019-009.''

SUPPLEMENTARY INFORMATION:

I. Background

Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Pub. L. 115-232) prohibits executive agencies from entering into, or extending or renewing, a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The provision goes into effect August 13, 2020.

The statute covers certain telecommunications equipment and services produced or provided by Huawei Technologies Company or ZTE

Page 2 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020)

Corporation (or any subsidiary or affiliate of those entities) and certain video surveillance products or telecommunications equipment and services produced or provided by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of those entities). The statute is not limited to contracting with entities that use end-products produced by those companies; it also covers the use of any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system.

Section 889 has two key sections, Section 889(a)(1)(A) and Section(a)(1)(B). Section (a)(1)(A) went into effect via FAR Case 2018- 017 at 84 FR 40216 on August 13, 2019. The 889(a)(1)(A) rule does the following:

It amends the FAR to include the 889(a)(1)(A) prohibition, which prohibits agencies from procuring or obtaining equipment or services that use covered telecommunications equipment or services as a substantial or essential component or critical technology. (FAR 52.204- 25) It requires every offeror to represent prior to award whether or not it will

[[Page 42666]] provide covered telecommunications equipment or services and, if so, to furnish additional information about the covered telecommunications equipment or services. (FAR 52.204-24) It mandates that contractors report (within one business day) any covered telecommunications equipment or services discovered during the course of contract performance. (FAR 52.204-25) In order to decrease the burden on contractors, the FAR Council published a second interim rule for 889(a)(1)(A), at 84 FR 68314 on December 13, 2019. This rule allows an offeror that represents ``does not'' in the annual representation at FAR 52.204-26 to skip the offer-by-offer representation within the provision at FAR 52.204-24.

The FAR Council will address the public comments received on both previous interim rules in a subsequent rulemaking. In addition, each agency has the opportunity under 889(a)(1)(A) to issue agency-specific procedures (as they do for any acquisition-related requirement). For example, GSA issued a FAR deviation \1\ where GSA categorized risk to eliminate the representations for low and medium risk GSA-funded orders placed under GSA indefinite-delivery contracts. For agency-specific procedures, please consult with the requiring agency.

\1\ https://www.acquisition.gov/gsa-deviation/supply-chain-aug13.

This rule implements 889(a)(1)(B) and requires submission of a representation with each offer that will require all offerors to represent, after conducting a reasonable inquiry, whether covered telecommunications equipment or services are used by the offeror. DoD, GSA, and NASA recognize that some agencies may need to tailor the approach to the information collected based on the unique mission and supply chain risks for their agency.

In order to reduce the information collection burden imposed on offerors subject to the rule, DoD, GSA, and NASA are currently working on updates to the System for Award Management (SAM) to allow offerors to represent annually after conducting a reasonable inquiry. Only offerors that provide an affirmative response to the annual representation would be required to provide the offer-by-offer representation in their offers for contracts and for task or delivery orders under indefinite-delivery contracts. Similar to the initial rule

Page 3 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020) for section 889(a)(1)(A), that was published as an interim rule on August 13, 2019 and was followed by a second interim rule on December 13, 2019 to update the System for Award Management, the FAR Council intends to publish a subsequent rulemaking once the updates are ready in SAM.

Overview of the Rule

This rule implements section 889 (a)(1)(B) and applies to Federal contractors' use of covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The rule seeks to avoid the disruption of Federal contractor systems and operations that could in turn disrupt the operations of the Federal Government, which relies on contractors to provide a range of support and services. The exfiltration of sensitive data from contractor systems arising from contractors' use of covered telecommunications equipment or services could also harm important governmental, privacy, and business interests. Accordingly, due to the privacy and security risks associated with using covered telecommunications equipment or services as a substantial or essential component or critical technology of any system, the prohibition applies to any use that meets the threshold described above.

It amends the following sections of the FAR:

FAR subpart 4.21, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

The provision at 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment.

The contract clause at 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

Definitions Discussed in This Rule

This rule does not change the definition adopted in the first interim rule of ``critical technology,'' which was included in the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) (Section 1703 of Title XVII of the NDAA for FY 2019, Pub. L. 115-232, 50 U.S.C. 4565(a)(6)(A)). The rule does not change the definitions of ``Covered foreign country,'' ``Covered telecommunications equipment or services,'' and ``Substantial or essential component.'' The term offeror will continue to refer to only the entity that executes the contract.

This rule also adds new definitions for ``backhaul,'' ``interconnection arrangements,'' ``reasonable inquiry,'' and ``roaming,'' to provide clarity regarding when an exception to the prohibition applies. These terms are not currently defined in Section 889 or within the FAR. These definitions were developed based on consultation with subject matter experts as well as analyzing existing telecommunications regulations and case law.\2\

\2\ See FiberTower Spectrum Holdings, LLC v. F.C.C., 782 F.3d 692, 695 (D.C. Cir. 2015); Worldcall Interconnect, Inc. v. Fed.

Commc'ns Comm'n, 907 F.3d 810, 814 (Nov. 15, 2018).

The FAR Council is considering as part of finalization of this rulemaking with an effective date no later than August 13, 2021, to expand the scope to require that the prohibition at 52.204-24(b)(2) and 52.204-25(b)(2) applies to the offeror and any affiliates, parents, and subsidiaries of the offeror that are domestic concerns, and expand the

Page 4 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020) representation at 52.204-24(d)(2) so that the offeror represents on behalf of itself and any affiliates, parents, and subsidiaries of the offeror that are domestic concerns, as to whether they use covered telecommunications equipment or services. Section IV of this rule is requesting specific feedback regarding the impact of this potential change, as well as other pertinent policy questions of interest, in order to inform finalization of this and potential future subsequent rulemakings.

II. Discussion and Analysis

To implement section 889(a)(1)(B), the contract clause at 52.204-25 was amended to prohibit agencies ``from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system,'' unless an exception applies or a waiver is granted. This prohibition applies at the prime contract level to an entity that uses any equipment, system, or service that itself uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, regardless of whether that usage is in performance of work under a Federal contract.

The 52.204-25 prohibition under section 889(a)(1)(A) will continue to flow down to all subcontractors; however, as required by statute the prohibition for section 889(a)(1)(B) will not flow down because the prime contractor is the only ``entity'' that the agency ``enters into a contract'' with, and an agency does not directly ``enter into a contract'' with any subcontractors, at any tier.

The rule also adds text in subpart 13.2, Actions at or Below the Micro-

[[Page 42667]]

Purchase Threshold, to address section 889(a)(1)(B) with regard to micro-purchases. The prohibition will apply to all FAR contracts, including micro-purchase contracts.

Representation Requirements

Representations and Certifications are requirements that anyone wishing to apply for Federal contracts must complete. They require entities to represent or certify to a variety of statements ranging from environmental rules compliance to entity size representation.

Similar to the previous rule for section 889(a)(1)(A), that was published as an interim rule on August 13, 2019, and was followed by a second interim rule on December 13, 2019, that updated the System for Award Management (SAM), the FAR Council is in the process of making updates to SAM requiring offerors to represent whether they use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services within the meaning of this rule. This rule will add a new OMB Control Number to the list at FAR 1.106 of OMB approvals under the Paperwork Reduction Act. Offerors will consult SAM to validate whether they use equipment or services listed in the definition of ``covered telecommunications equipment or services'' (see FAR 4.2101).

An entity may represent that it does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services within the meaning of this rule, if a reasonable inquiry by the entity does not reveal or identify any such use. A reasonable inquiry is an inquiry designed to uncover any information in the entity's possession about the identity of the producer or provider of covered

Page 5 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020) telecommunications equipment or services used by the entity. A reasonable inquiry need not include an internal or third-party audit.

Grants

Grants are not part of this FAR based regulation and are handled separately. Please note guidance on Section 889 for grants, which are not covered by this rule, was posted for comment at https://www.federalregister.gov/docu

Agency Waiver Process

Under certain circumstances, section 889(d)(1) allows the head of an executive agency to grant a one-time waiver from 889(a)(1)(B) on a case-by-case basis that will expire no later than August 13, 2022.

Executive agencies must comply with the prohibition once the waiver expires. The executive agency will decide whether or not to initiate the formal waiver process based on market research and feedback from Government contractors during the acquisition process, in concert with other internal factors. The submission of an offer will mean the offeror is seeking a waiver if the offeror makes a representation that it uses covered telecommunications equipment or services as a substantial or essential component of a system, or as critical technology as part of any system and no exception applies. Once an offeror submits its offer, the contracting officer will first have to decide if a waiver is necessary to make an award and then request the offeror to provide: (1) A compelling justification for the additional time to implement the requirements under 889(a)(1)(B), for consideration by the head of the executive agency in determining whether to grant a waiver; (2) a full and complete laydown of the presences of covered telecommunications or video surveillance equipment or services in the entity's supply chain; and (3) a phase-out plan to eliminate such covered telecommunications equipment or services from the entity's systems. This does not preclude an offeror from submitting this information with their offer, in advance of a contracting officer decision to initiate the formal waiver request through the head of the executive agency.

Since the formal waiver is initiated by an executive agency and the executive agency may not know if covered telecommunications equipment or service will be used as part of the supply chain until offers are received, a determination of whether a waiver should be considered may not be possible until offers are received and the executive agency analyzes the representations from the offerors.

Given the extent of information necessary for requesting a waiver, the FAR Council anticipates that any waiver would likely take at least a few weeks to obtain. Where mission needs do not permit time to obtain a waiver, agencies may reasonably choose not to initiate one and to move forward and make award to an offeror that does not require a waiver.

Currently, FAR 4.2104 directs contracting officers to follow agency procedures for initiating a waiver request. Since a waiver is based on the agency's judgment concerning particular uses of covered telecommunications equipment or services, a waiver granted for one agency will not necessarily shed light on whether a waiver is warranted in a different procurement with a separate agency. This agency waiver process would be the same for both new and existing contracts. If a waiver is granted, with respect to particular use of covered telecommunications equipment or services, the contractor will still be required to report any additional use of covered telecommunications equipment or services discovered or identified during contract performance in accordance with 52.204-25(d).

Before granting a waiver, the agency must: (1) Have designated a senior agency official for supply chain risk management, responsible for ensuring the agency effectively carries out the supply chain risk

Page 6 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020) management functions and responsibilities described in law, regulation, and policy; additionally this senior agency official will serve as the primary liaison with the Federal Acquisition Security Council (FASC);

(2) establish participation in an information-sharing environment when and as required by the FASC to facilitate interagency sharing of relevant supply chain risk information; and (3) notify and consult with the Office of the Director of National Intelligence (ODNI) on the issue of the waiver request: The agency may only grant the waiver request after consulting with ODNI and confirming that ODNI does not have existing information suggesting that the waiver would present a material increase in risk to U.S. national security. Agencies may satisfy the consultation requirement by making use of one or more of the following methods as made available to agencies by ODNI (as appropriate): Guidance, briefings, best practices, or direct inquiry.

If the agency has met the three conditions enumerated above and intends to grant the waiver requested, the agency must notify the ODNI and the FASC 15 days prior to granting the waiver, and provide notice to the appropriate Congressional committees within 30 days of granting the waiver. The notice must include:

(1) An attestation by the agency that granting of the waiver would not, to the agency's knowledge having conducted the necessary due diligence as directed by statute and regulation, present a material increase in risk to U.S. national security; and

(2) The required full and complete laydown of the presences of covered telecommunications or video surveillance equipment or services in the entity's supply chain; and

[[Page 42668]]

(3) The required phase-out plan to eliminate covered telecommunications or video surveillance equipment or services from the entity's systems.

The laydown described above must include a description of each category of covered telecommunications or video surveillance equipment or services discovered after a reasonable inquiry, as well as each category of equipment, system, or service used by the entity in which such covered technology is found after such an inquiry.

In the case of an emergency, including a declaration of major disaster, in which prior notice and consultation with the ODNI and prior notice to the FASC is impracticable and would severely jeopardize performance of mission-critical functions, the head of an agency may grant a waiver without meeting the notice and consultation requirements to enable effective mission critical functions or emergency response and recovery. In the case of a waiver granted in response to an emergency, the head of an agency granting the waiver must make a determination that the notice and consultation requirements are impracticable due to an emergency condition, and within 30 days of award, notify the ODNI, the FASC, and Congress of the waiver issued under emergency circumstances.

The provision of a waiver does not alter or amend any other requirements of U.S. law, including any U.S. export control laws and regulations or protections for sensitive sources and methods. In particular, any waiver issued pursuant to these regulations is not authorization by the U.S. Government to export, reexport, or transfer (in-country) items subject to the Export Administration or International Traffic in Arms Regulations (15 CFR 730-774 and 22 CFR 120-130, respectively).

Director of National Intelligence Waiver

The statute also permits the Director of National Intelligence (DNI) to provide a waiver if the Director determines one is in the national security interests of the United States.\3\ The statute does

Page 7 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020) not include an expiration date for the DNI waiver. This authority is separate and distinct from that granted to an agency head as outlined above.

\3\ Sec. 889(d)(2).

ODNI Categorical Scenarios

Additionally, the ODNI, in consultation with the FASC, will issue on an ongoing basis, for use in informing agency waiver decisions, guidance describing categorical uses or commonly-occurring use scenarios where presence of covered telecommunications equipment or services is likely or unlikely to pose a national security risk.

Other Technical Changes

The solicitation provision at 52.204-24 has two representations, one for 889(a)(1)(A) and one for 889(a)(1)(B). This rule adds the representation for 889(a)(1)(B). The solicitation provision at 52.204- 24 also has two disclosure sections, one for 889(a)(1)(A) and one for 889(a)(1)(B). This rule adds the disclosure section for 889(a)(1)(B) with separate reporting elements depending on whether the procurement is for equipment, services related to item maintenance, or services not associated with item maintenance. The reporting elements within the disclosure are different for each category because the information needed to identify whether the prohibition applies varies for these three types of procurements. This rule also administratively renumbers the paragraphs under the disclosure section. Finally, this rule will add cross-references in FAR parts 39, Acquisition of Information Technology, and to the coverage of the section 889 prohibition at FAR subpart 4.21.

Expected Impact of This Rule

The FAR Council recognizes that this rule could impact the operations of Federal contractors in a range of industries--including in the health-care, education, automotive, aviation, and aerospace industries; manufacturers that provide commercially available off-the-shelf (COTS) items; and contractors that provide building management, billing and accounting, and freight services. The rule seeks to minimize disruption to the mission of Federal agencies and contractors to the maximum extent possible, consistent with the Federal Government's ability to ensure effective implementation and enforcement of the national security measures imposed by Section 889. As set forth in Section III.C below, the FAR Council recognizes the substantial benefits that will result from this rule.

To date, there is limited information on the extent to which the various industries will be impacted by this rule implementing the statutory requirements of section 889. To better understand the potential impact of section 889 (a)(1)(B), DoD hosted a public meeting on March 2, 2020 (See 85 FR 7735) to facilitate the Department's planning for the implementation of Section 889(a)(1)(B).

NASA also hosted a Section 889 industry engagement event on January 30, 2020, to obtain additional information on the impact this prohibition will have on NASA contractors' operations and their ability to support NASA's mission.

In addition, the FAR Council hosted a public meeting on July 19, 2019, and GSA hosted an industry engagement event on November 6, 2019 (https://interact.gsa.gov/FY19NDAASection889) to gather additional information on how section 889 could affect GSA's business and supply chain. The presentations are located at https://interact.gsa.gov/FY19NDAASection889.

Page 8 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020)

Please note presentations and comments from the public meetings are not considered public comments on this rule.

The FAR Council notes this rule is one of a series of actions with regard to section 889 and the impact and costs to all industry sectors, including COTS items manufacturers, resellers, consultants, etc. is not well understood and is still being assessed. For example, in a filing to the Federal Communications Commission, the Rural Wireless Association estimated that at least 25% of its carriers would be impacted.\4\

\4\ https://ecfsapi.fcc.gov/file/12080817518045/FY%202019%20NDAA%20Reply%20Comments%

In addition, while the rule will be effective as of August 13, 2020, the FAR Council is seeking public comment, including, as indicated below, on the potential impact of the rule on the affected industries. After considering the comments received, a final rule will be issued, taking into account and addressing the public comments. See 41 U.S.C. 1707.

Industry Costs for New Representation and Scope of Section 889(a)(1)(B)

The statute includes two exceptions at 889 (a)(2)(A) and (B). The exception at 889(a)(2)(A) allows the head of executive agency to procure with an entity ``to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements.'' The exception at 889(a)(2)(B) allows an entity to procure ``telecommunications equipment that cannot route or redirect user data traffic or [cannot] permit visibility into any user data or packets that such equipment transmits or otherwise handles.'' The exception allowing for procurement of services that connect to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements applies only to a Government agency that is contracting with an entity to provide a service. Therefore, the exception does

[[Page 42669]] not apply to a contractor's use of a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements. As a result, the Federal Government is prohibited from contracting with a contractor that uses covered telecommunications equipment or services to obtain backhaul services from an internet service provider, unless a waiver is granted.

III. Regulatory Impact Analysis Pursuant to Executive Orders 12866 and 13563

The costs and transfer impacts of section 889(a)(1)(B) are discussed in the analysis below. This analysis was developed by the FAR Council in consultation with agency procurement officials and OMB. We request public comment on the costs, benefits, and transfers generated by this rule.

A. Risks to Industry of Not Complying With 889

As a strictly contractual matter, an organization's failure to submit an accurate representation to the Government constitutes a breach of contract that can lead to cancellation, termination, and financial consequences.

Therefore, it is important for contractors to develop a compliance plan that will allow them to submit accurate representations to the

Page 9 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020)

Government in the course of their offers.

B. Contractor Actions Needed for Compliance

Adopting a robust, risk-based compliance approach will help reduce the likelihood of noncompliance. During the first year that 889(a)(1)(B) is in effect, contractors and subcontractors will need to learn about the provision and its requirements as well as develop a compliance plan. The FAR Council assumes the following steps would most likely be part of the compliance plan developed by any entity.

1. Regulatory Familiarization. Read and understand the rule and necessary actions for compliance.

2. Corporate Enterprise Tracking. The entity must determine through a reasonable inquiry whether the entity itself uses ``covered telecommunications'' equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This includes examining relationships with any subcontractor or supplier for which the prime contractor has a Federal contract and uses the supplier or subcontractor's ``covered telecommunications'' equipment or services as a substantial or essential component of any system. A reasonable inquiry is an inquiry designed to uncover any information in the entity's possession--primarily documentation or other records--about the identity of the producer or provider of covered telecommunications equipment or services used by the entity. A reasonable inquiry need not include an internal or third-party audit.

3. Education. Educate the entity's purchasing/procurement, and materials management professionals to ensure they are familiar with the entity's compliance plan.

4. Cost of Removal (if the entity independently decides to). Once use of covered equipment and services is identified, implement procedures if the entity decides to replace existing covered telecommunications equipment or services and ensure new equipment and services acquired for use by the entity are compliant.

5. Representation. Provide representation to the Government regarding whether the entity uses covered telecommunications equipment and services and alert the Government if use is discovered during contract performance.

6. Cost to Develop a Phase-out Plan and Submit Waiver Information.

For entities for which a waiver will be requested, (1) develop a phase-out plan to phase-out existing covered telecommunications equipment or services, and (2) provide waiver information to the Government to include the phase-out plan and the complete laydown of the presence of the covered telecommunications equipment or services.

C. Benefits

This rule provides significant national security benefits to the general public. According to the White House article ``A New National Security Strategy for a New Era'', the four pillars of the National Security Strategy (NSS) are to protect the homeland, promote American prosperity, preserve peace through strength, and advance American influence.\5\ The purpose of this rule is to align with the NSS pillar to protect the homeland, by protecting the homeland from the impact of Federal contractors using covered telecommunications equipment or services that present a national security concern.

\5\ https://www.whitehouse.gov/articles/new-national-security-strategy-new-era/.

The United States faces an expanding array of foreign intelligence threats by adversaries who are using increasingly sophisticated methods

Page 10 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020) to harm the Nation.\6\ Threats to the United States posed by foreign intelligence entities are becoming more complex and harmful to U.S.

interests.\7\ Foreign intelligence actors are employing innovative combinations of traditional spying, economic espionage, and supply chain and cyber operations to gain access to critical infrastructure, and steal sensitive information and industrial secrets.\8\ The exploitation of key supply chains by foreign adversaries represents a complex and growing threat to strategically important U.S. economic sectors and critical infrastructure.\9\ The increasing reliance on foreign-owned or controlled telecommunications equipment, such as hardware or software, and services, as well as the proliferation of networking technologies may create vulnerabilities in our nation's supply chains.\10\ The evolving technology landscape is likely to accelerate these trends, threatening the security and economic well-being of the American people.\11\

\6\ National Counterintelligence Strategy of the United States of America 2020-2022.

\7\ National Counterintelligence Strategy of the United States of America 2020-2022.

\8\ National Counterintelligence Strategy of the United States of America 2020-2022.

\9\ National Counterintelligence Strategy of the United States of America 2020-2022.

\10\ National Counterintelligence Strategy of the United States of America 2020-2022.

\11\ National Counterintelligence Strategy of the United States of America 2020-2022.

Since the People's Republic of China possesses advanced cyber capabilities that it actively uses against the United States, a proactive cyber approach is needed to degrade or deny these threats before they reach our nation's networks, including those of the Federal Government and its contractors. China is increasingly asserting itself by stealing U.S. technology and intellectual property in an effort to erode the United States' economic and military superiority.\12\ Chinese companies, including the companies identified in this rule, are legally required to cooperate with their intelligence services.\13\ China's reputation for persistent industrial espionage and close collaboration between its government and industry in order to amass technological secrets presents additional threats for U.S. Government contractors.\14\ Therefore, there is a risk

[[Page 42670]] that Government contractors using 5th generation wireless communications (5G) and other telecommunications technology from the companies covered by this rule could introduce a reliance on equipment that may be controlled by the Chinese intelligence services and the military in both peacetime and crisis.\15\

\12\ National Counterintelligence Strategy of the United States of America 2020-2022.

\13\ NATO Cooperative Cyber Defense Center of Excellence Report on Huawei, 5G and China as a Security Threat.

\14\ NATO Cooperative Cyber Defense Center of Excellence Report on Huawei, 5G and China as a Security Threat.

\15\ NATO Cooperative Cyber Defense Center of Excellence Report on Huawei, 5G and China as a Security Threat.

Page 11 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020)

The 2019 Worldwide Threat Assessment of the Intelligence Community \16\ highlights additional threats regarding China's cyber espionage against the U.S. Government, corporations, and allies. The U.S.-China Economic and Security Review Commission Staff Annual Reports \17\ provide additional details regarding the United States' national security interests in China's extensive engagement in the U.S.

telecommunications sector. In addition, the U.S. Senate Select Committee on Intelligence Open Hearing on Worldwide Threats \18\ further elaborates on China's approach to gain access to the United States' sensitive technologies and intellectual property. The U.S.

House of Representatives Investigative Report on the U.S. National Security Issues Posed by Chinese Telecommunications Companies Huawei and ZTE \19\ further identifies how the risks associated with Huawei's and ZTE's provision of equipment to U.S. critical infrastructure could undermine core U.S. national-security interests.

\16\ https://www.dni.gov/files/ODNI/documents/2019-ATA-SFR_- SSCI.pdf.

\17\ https://www.uscc.gov/annual-reports/archives.

\18\ https://www.intelligence.senate.gov/sites/default/files/hearings/CHRG-115shrg28 \19\ https://intelligence.house.gov/news/documentsingle.aspx?DocumentID=96.

Currently, Government contractors may not consider broad national security interests of the general public when they make decisions. This rule ensures that Government contractors keep public national security interests in mind when making decisions, by ensuring that, pursuant to statute, they do not use covered telecommunications equipment or services that present national security concerns. This rule will also assist contractors in mitigating supply chain risks (e.g. potential theft of trade secrets and intellectual property) due to the use of covered telecommunications equipment or services.

D. Public Costs

During the first year after publication of the rule, contractors will need to learn about the provisions and its requirements. The DOD, GSA, and NASA (collectively referred to here as the Signatory Agencies) estimate this cost by multiplying the time required to review the regulations and guidance implementing the rule by the estimated compensation of a general manager.

To estimate the burden to Federal offerors associated with complying with the rule, the percentage of Federal contractors that will be impacted was pulled from Federal databases. According to data from the System for Award Management (SAM), as of February 2020, there were 387,967 unique vendors registered in SAM. As of September 2019, about 74% of all SAM entities registered for all awards were awarded to entities with the primary NAICS code as small; therefore, it is assumed that out of the 387,967 unique vendors registered in SAM in February 2020, 287,096 entities are unique small entities. According to data from the Federal Procurement Data System (FPDS), as of February 2020, there was an average of 102,792 unique Federal awardees for FY16-FY19, of which 73%, 75,112, are unique small entities. Based on data in SAM for FY16-FY19, the Signatory Agencies anticipates there will be an average of 79,319 \20\ new entities registering annually in SAM, of which 74%, 57,956, are anticipated to be small businesses.

\20\ This value is based on data on new registrants in SAM.gov on average for FY16, FY17, FY18, and FY19.

Page 12 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020)

We estimate that this rule will also affect businesses which become Federal contractors in the future. As stated above, we estimate that there are 79,319 \21\ new entrants per year.

\21\ This value is based on data on new registrants in SAM.gov for FY19 and FY20.

1. Time To Review the Rule Below is a list of compliance activities related to regulatory familiarization that the Signatory Agencies anticipate will occur after issuance of the rule:

a. Familiarization with FAR 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment. The Signatory Agencies assume that it will take all vendors who plan to submit an offer for a Federal award 20 \22\ hours to familiarize themselves with the amendment to the offer-by-offer representation at 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment. The Signatory Agencies assume that all entities registered in SAM, or 387,967 \23\ entities, plan to submit an offer for a Federal award, since there is no data available on number of offerors for Federal awards. Therefore, the Signatory Agencies calculated the total estimated cost for this part of the rule to be $735 million (= 20 hours x $94.76 \24\ per hour x 387,967). Of the 387,967 entities impacted by this part of the rule, it is assumed that 74% \25\ or 287,096 entities are unique small entities.

\22\ The 20 hours are an assumption based on historical familiarization hours and subject matter expert judgment.

\23\ According to data from the System for Award Management (SAM), as of February 2020, there were 387,967 unique vendors registered in SAM.

\24\ The rate of $94.76 assumes an FY19 GS 13 Step 5 salary (after applying a 100% burden to the base rate) based on subject matter judgment.

\25\ As of September 2019, about 74% of all SAM entities registered for all awards were awarded to entities with the primary NAICS code as small.

In subsequent years, these costs will be incurred by 79,319 \26\ new entrants each year. Therefore, the Signatory Agencies calculated the total estimated cost for this part of the rule to be $150 million (= 20 hours x $94.76 per hour x 79,319) per year in subsequent years.

\26\ This value is based on data on new registrants in SAM.gov on average for FY16, FY17, FY18, and FY19.

b. Familiarization with FAR 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. The Signatory Agencies estimate that it will take all vendors who plan to submit an offer for a Federal award 8 \27\ hours to familiarize themselves with the amendment to the clause at 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. The average number of unique awardees for FY16-FY19, or 102,792 \28\ entities, will be impacted by this part of the rule, assuming all entities awarded Federal contracts

Page 13 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020) would have to familiarize themselves with the clause. Therefore, the Signatory Agencies calculated the total estimated cost for this part of the rule to be $78 million (= 8 hours x $94.76 per hour x 102,792). Of the 102,792 unique Federal awardees assumed to be impacted by this part of the rule, 73% or 75,038, are unique small entities.

\27\ The 8 hours is an assumption based on historical familiarization hours and subject matter expert judgment.

\28\ As of February 2020, there was an average of 102,792 unique Federal awardees for FY16-FY19.

In subsequent years, these costs are estimated will be incurred by 26% \29\ of new entrants, or 20,623 entities because it is assumed that 26% of new entrants will be awarded a Federal contract and will be required to familiarize

[[Page 42671]] themselves with the clause. Therefore, the Signatory Agencies calculated the total estimated cost for this part of the rule to be $15.6 million (= 8 hours x $94.76 per hour x 20,623) per year in subsequent years.

\29\ The percentage of 26% is the percentage of active entities registered in SAM.gov in FY20 that were awarded contracts.

The total cost estimated to review the amendments to the provision and the clause is estimated to be $813 million in the first year after publication. In subsequent years, this cost is estimated to be $166 million annually. The FAR Council acknowledges that there is substantial uncertainty underlying these estimates.

2. Time To Establish a Corporate Enterprise Tracking Tool and Verify Covered Telecom Is Not Used Within the Corporation or by the Corporation and Ensure There Are No Future Buys In order to complete the representation, the entity must determine, by conducting a reasonable inquiry whether the entity itself uses ``covered telecommunications'' equipment or services. This includes a relationship with any subcontractor or supplier in which the prime contractor has a Federal contract and uses the supplier or subcontractor's ``covered telecommunications equipment or services'' regardless of whether that usage is in performance of work under a Federal contract. The Signatory Agencies do not have reliable data to form an estimate as to the processes vendors will adopt to conduct a reasonable inquiry or the costs, in time and other resources, for conducting such an inquiry. The Signatory Agencies intend to evaluate any information on this topic in the comments submitted by the public.

3. Time To Complete Corporate-Wide Training on Compliance Plan The Signatory Agencies estimate that most entities have already begun to understand the impact of Section 889 (a)(1)(A) and have already educated the appropriate personnel to that part of the prohibition. Section 889 (a)(1)(B) requires a more robust training of the organization's compliance plan, which include business partners that are outside of the typical ``covered telecommunications equipment or services'' purchases; such as day-day office supplies. The Signatory Agencies estimate that it will take all vendors at least 4 \30\ hours of training to ensure personnel understand the organization's compliance plan for tracking partners that procure ``covered telecommunications equipment and services'' that may be indirectly related to their respective business activities. Therefore, the

Page 14 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020)

Signatory Agencies calculated the total estimated cost for this part of the rule to be $147 million (= 4 hours x $94.76 per hour x 387,967).

\30\ The hours are an assumption based on subject matter expert judgment.

Of the 387,967 \31\ entities impacted by this part of the rule, it is assumed that 74% or 287,096 entities are unique small entities.

\31\ According to data from the System for Award Management (SAM), as of February 2020, there were 387,967 unique vendors registered in SAM.

In subsequent years, we assume that 50% \32\ of the 79,319 \33\ new entrants will incur these costs. Therefore, the Signatory Agencies calculated the total estimated cost for this part of the rule to be $15 million (= 4 hours x $94.76 per hourx 50% x 79,319) per year in subsequent years. The FAR Council acknowledges that there is substantial uncertainty underlying these estimates.

\32\ The 50% value is an assumption based on subject matter expert judgment. In the absence, to be conservative, it assumes that 50% of new entrants will decide to perform corporate-wide training.

\33\ This value is based on data on new registrants in SAM.gov on average for FY16, FY17, FY18, and FY19.

4. Time To Remove and Replace Existing Equipment or Services (if Contractor Decides to) in Order To Be Eligible for a Federal Contract Data on the extent of the presence of the covered telecommunications equipment and services in the global supply chain is extremely limited, as is information as to the costs of removing and replacing covered equipment or services where it does exist.

Furthermore, no data exists as to how many entities will receive a 2-year waiver from executive agency heads or a non-time-limited waiver from the ODNI. Accordingly, the Signatory Agencies are unable to form any estimate of the costs of this rule with regard to removing and replacing existing equipment and services. The Signatory Agencies intend to evaluate any information provided on this topic in comments submitted by the public.

5. Time To Complete the Representation 52.204-24 For the offer-by-offer representation at FAR 52.204-24 the Signatory Agencies assumed the cost for this portion of the rule to be $11 billion (= 3 \34\ hours x $94.76 per hour x 102,792 unique entities x 378 \35\ responses per entity).

\34\ The hours are an assumption based on subject matter expert judgment.

\35\ The responses per entity is calculated by dividing the average number of annual awards in FY16-19 by the average number of unique entities awarded a contract (38,854,291 awards/102,792 unique awardees = 378).

In subsequent years, we assume that 26% \36\ of new entrants will complete an offer and need to complete the offer-by-offer

Page 15 of 35Federal Register, Volume 85 Issue 135 (Tuesday, July 14, 2020) representation. Therefore, these costs will be incurred by 26% of the 79,319 \37\ new entrants each year.