The ban on federal contractor use of certain Chinese made equipment is getting to be something of a nightmare. The ban starts in less than a month. The rule for how to facilitate the ban is barely out from the Federal Acquisition Regulation Council. With analysis, Miller and Chevalier partner Jason Workmaster joined Federal Drive with Tom Temin.
Insight by Tenable: Learn how Naval Facilities Engineering Systems Command uses a private cloud enclave helps keep control systems safe from cyber vulnerabilities in this free webinar.
Tom Temin: Mr. Workmaster, good to have you on.
Jason Workmaster: Good to be here. Thank you so much for having me.
Tom Temin: This rule has been long awaited because the law that caused this ban does go into effect here orders contractors to do or not do certain things by August 13. Give us the status. Is there time for formal rulemaking or does this proposed rule just become effective?
Jason Workmaster: This interim rule will become effective on August 13. The only thing at this point that would really stop or change anything would be if Congress passes legislation that changes the effective date of the legislation, because the August 13 state Congress itself established a couple years ago back in the 2019 NDAA, which was passed back in 2018. So this date has been coming for a while, wasestablished by Congress. We were hoping to see rules much sooner than this, according to the regulators, the COVID pandemic got in the way of getting this rule out sooner. So now it’s coming out here with just about a month before the rule goes into effect. Like I said, unless Congress does something, that’s what’s going to happen on August 13th.
Tom Temin: Well did industry that’s affected by this have any chance to weigh in with comments in any kind of proposal before this rule came out?
Jason Workmaster: There was actually before everything shut down, back in February, March, DoD held a public meeting where there was a lot of folks in attendance, a lot of industry that got to at least state their views. For pretty much the entire time since Congress passed this legislation a couple years ago, through that public meeting industries respondes, then this is going to be, if you read this legislation and now this rule for all their worth, this could be a very heavy compliance burden. A lot of cost involved. And there was discussion with the government back at that public meeting about how broad the ban is because the ban extends to the use of any system, equipment or service that uses any of the banned technology. So what does it mean to use any of these systems? What does it mean to use these technologies? And DoD said that’s very broad — and that’s what we’re seeing and the rule.
Tom Temin: Before we get into the specifics of that rule, I just want to nail down this idea that this law passed a couple of years ago — and the rulemaking did not really come up with a rule until three weeks before the deadline after two years and they’re blaming the pandemic — have I got that right?
Jason Workmaster: You are correct. You are correct. Yeah, I think the thought was they would have gotten a rule out maybe in March or so. The only thing I can say is that this is better than what happened last year, because as you probably know, this legislation had two different bans in it. The first ban which was a narrower ban, the rule for that came out the day it went into effect. So that ban went into effect August 13 2019, and that’s the day the rule issued and it had immediate effect. So in this case, they actually got the rule out a little sooner than they did last year.
Tom Temin: But really, under the standards that we’ve come to expect and rulemaking, this doesn’t quite live up to them, does it?
Jason Workmaster: This is really for the contracting industry a very frustrating place to be in without really a meaningful opportunity to provide formal comments on this rule before it goes into effect. The public meeting was helpful, but yes we would have preferred greatly to have seen rules on this a year ago, and had been able to go through the normal process of proposed rule and then you comment and industry works it out with the government before you see this judge rule hit the street.
Tom Temin: And let’s go to the rule itself — what’s in it and what kind of trouble does it propose for contractors now?
Jason Workmaster: This rule, it bans the government, it prohibits the government from entering into a contract with any entity that uses, and that’s the word in the statute, uses is the word and the rule, any system, equipment or service that uses certain banned Chinese telecommunications technologies, chief among them are Huawei telecommunications equipment, also ZTE is specifically called out. The concern of course is security. The government wants to get Huawei/ZTE equipment out of technology systems here in the United States. And so this would, on its face and as the rule says, this would prohibit the government from awarding a contract to any entity that uses that equipment. Of course Huawei and ZTE equipment is ubiquitous. So DoD actually in this rule has recognized that if this goes into effect, the cost to comply with this is going to be quite steep. And so we’ve been talking talking to clients now for a good while about what they can be doing to get ready for this. And even just taking an inventory of your systems to determine if you have any of this equipment, that’s a significant thing. And the other piece of this is that where it says that it will prohibit the government from contracting with an entity that uses services that use this equipment, well that extends down your supply chain. So if you’re using a subcontractor do to perform a service for you, and they use the equipment, there’s an argument there that that is within the reach of the ban, as well as any other vendors you might use.
Tom Temin: Sounds like there could be a lot of capricious application of it, especially as it gets deep into a subcontractors supply chain or contractors subs.
Jason Workmaster: Yes, absolutely. And you know what the prime is going to have to due to determine if it’s subs have the equipment, this new rule does say that the prime contractor does not have to conduct an audit, but it says that they need to make a reasonable inquiry. As a as a lawyer who’s worked in this field for a good while now, when you have terms like reasonable inquiry, that’s the kind of thing that often is in the eye of the beholder. And it’s the kind of standard, that down the road, that’s the kind of thing where you can get into fights litigation over well did you really perform a reasonable inquiry or not? And that leaves room for Monday morning quarterbacking and second guessing.
Tom Temin: Yes, but just to play devil’s advocate for a second here, knowing for two years that this was eventually going to happen, couldn’t the companies have done that inventory and devised a plan for switching out that equipment over time so it doesn’t all have to be discovered and replaced at once?
Jason Workmaster: Absolutely. Contractors have known about this for a while, and a lot of contractors have been getting ready for this. But in the absence, there remained a hope that when the rule came out, the rule would put a little bit more meat on the bones of what it meant to use this equipment — and the rule really did not do that. So there was a lot of hope in the contracting community, that the regulator’s, because use is a very broad word, and there could be various interpretations of it. I think part of it was a chicken and egg problem. Industry was thinking, what standard are we actually having to comply with? Is it going to be as broad as possible under the statutory language or are the regulators going to put some fences around exactly what it is we need to do. So there was a little bit of confusion for this entire time as to what the standard exactly was gonna be. And so to your point earlier, you know, we would have hoped to have seen proposed rule long ago so that these issues could have been worked out. Because anytime a contractor is going to start incurring costs like this, they want to make sure that they’re applying the correct standards so they don’t have to do it two or three times. But that didn’t happen — and now we’re staring at just a few weeks from now this thing goes into effect.
Tom Temin: Sounds like maybe a better standard would have been, instead of us would federal data or say unclassified but sensitive data, CY data, have contact with that particular equipment, as opposed to it being in the parking lot surveillance system?
Jason Workmaster: Right, exactly. That’s exactly right. And there’s actually there’s legislative activity going on right now on the hill to amend this ban in exactly that direction, to limit the ban to use of the equipment on your government contracts, which would be a much narrower ban, a lot easier to figure out. You can figure out what your federal business is and see if you’re using this equipment in your federal business without having to worry about completely commercial activities are engaged in, just overall business operations, you wouldn’t have to worry about those, it would be just directed to government contracting. But that legislation has been proposed, but has not yet been adopted. So right now the band remains overall use.
Tom Temin: So in the meantime, it sounds like a great Bonanza for say Cisco?
Jason Workmaster: For sure. Yes. I mean, it is a great Bonanza for anybody that’s not on the list. Regardless of whether this proposed legislation passes, that narrows the band, there’s also consideration to push the band out for another year that Congress is considering. Now regardless of whether any of that happens, the message we’ve been telling our clients, a ban of some type is coming. And we’ve known about that, the ban last year prohibited the government from procuring this kind of equipment itself. The ban this year is a lot broader, but we’ve known for a long time, and I don’t think it’s going to change anytime soon. We can see what just happened over in the UK, Huawei and ZTE equipment are not going to be on the preferred provider list anytime soon. This is something the contracting community regardless of the exact contours of how this ends up, are going to have to be living with for a good while. And of course, that is to companies like Cisco’s benefit.
Tom Temin: Jason Workmaster is a partner with the law firm Miller and Chevalier. Thanks so much for joining me.
Jason Workmaster: My pleasure.