Section 889 (Covered Telecommunications Equipment Ban)

Section 889 refers to Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (NDAA FY2019, Public Law 115-232), which bars federal agencies, federal contractors, and recipients of federal grants and cooperative agreements from procuring or using covered telecommunications equipment or services — a defined list of products from five named Chinese manufacturers. For federally funded research institutions, the operative implementing regulation is 2 CFR 200.216, added to the Uniform Guidance and effective August 13, 2020, which prohibits grant and cooperative-agreement recipients and subrecipients from using federal award funds to procure, obtain, extend, or renew a contract for covered equipment or services.

What counts as “covered telecommunications equipment or services”

Section 889 defines covered equipment and services as telecommunications or video surveillance equipment and services produced or provided by five named entities, or any subsidiary or affiliate of them:

• Huawei Technologies Company
• ZTE Corporation
• Hytera Communications Corporation
• Hangzhou Hikvision Digital Technology Company
• Dahua Technology Company

The prohibition also extends to telecommunications and video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the FBI, reasonably believes to be owned or controlled by, or otherwise connected to, the government of the People’s Republic of China. In practice this means the ban is not a fixed, closed list of five brand names forever — an institution’s export control or research security office needs to check current guidance rather than assume only the five named manufacturers are in scope.

How it applies to a federally funded research institution

Section 889 itself has two operative parts, both originally written for federal contractors: Part A (effective August 13, 2019) prohibits federal agencies from procuring covered equipment or services directly; Part B (effective August 13, 2020) prohibits federal agencies from contracting with an entity that itself uses covered equipment or services as a substantial or essential component of any system, or as critical technology, anywhere in that entity’s operations — not just on the federal award in question. 2 CFR 200.216 is the parallel implementation for the grant and cooperative-agreement side of federal funding, and it is narrower in one specific respect that matters for research administrators: it prohibits a recipient or subrecipient from using federal award funds to procure, obtain, extend, or renew a contract for covered equipment, services, or systems that use such equipment or services as a substantial or essential component or as critical technology. It does not, on its own, bar an institution from owning or using covered equipment somewhere else on campus purchased with non-federal funds — the prohibition attaches to the federal funding stream, not to institution-wide procurement generally. Costs incurred in violation of the prohibition are treated as unallowable under 2 CFR 200.471.

Because the certification runs through the award itself, sponsored-programs and procurement offices typically address Section 889 compliance at three points: (1) representations and certifications collected at proposal or award stage (SAM.gov registration includes a Section 889 representation covering the registrant generally); (2) procurement-office vetting of equipment purchase requests charged to a federal award, particularly for networking hardware, video conferencing systems, and surveillance/access-control cameras; and (3) periodic review of existing campus infrastructure (security camera systems are a recurring finding) to confirm nothing charged to an active federal award traces back to a covered manufacturer, including through a reseller or white-label product line, which is a common way covered components enter procurement undetected.

Relationship to other research-security and procurement rules

Section 889 is one of several distinct federal restrictions research administrators frequently need to track together, and it is easy to conflate them:

• FAR clauses 52.204-24/-25/-26/-27 implement Section 889 specifically for federal contracts (as opposed to grants), including the representation contractors must make regarding covered telecommunications equipment in their supply chain.
• 2 CFR 200.216 is the grant-side counterpart described above, and is the provision that applies to the large majority of university federal funding, which arrives as grants and cooperative agreements rather than procurement contracts.
• Section 889 is a procurement/supply-chain restriction, distinct from NIST SP 800-171 and CMMC, which govern how Controlled Unclassified Information is protected once an award is underway, and distinct from export-control regimes like ITAR/EAR, which govern the transfer of controlled technology and technical data rather than which vendors an institution may buy hardware from.

See the guide CMMC Compliance for Universities for how Section 889’s supply-chain restriction fits alongside the broader set of DoD-driven cybersecurity and research-security obligations a university sponsored-programs office now has to coordinate.

Examples

• A university’s IT department wants to install new campus security cameras and charge part of the cost to an active NSF cooperative agreement’s equipment budget. Procurement flags that the preferred vendor’s cameras are manufactured by Dahua under a private-label brand. Because the purchase would use federal award funds to procure covered equipment, it is blocked under 2 CFR 200.216 and the department must select a non-covered vendor or fund the purchase from non-federal sources.
• A research lab’s networking equipment refresh, funded entirely through state appropriations and philanthropic gift funds with no federal award funds involved, includes switches from a manufacturer later found to have used Hytera-made components. Because no federal award funds were used in the procurement, 2 CFR 200.216 does not itself prohibit the purchase — though the institution’s own risk-management or research-security policy may still restrict it independently, and the equipment could still create problems if it is later used on federally funded work.

Counter-example

A sponsored-programs office assumes Section 889 is only a contractor issue and does not apply to the university’s NIH and NSF grants because those are “grants, not contracts.” This misreads the regulation: 2 CFR 200.216 was added specifically to extend an equivalent prohibition to grant and cooperative-agreement recipients and subrecipients, so the vast majority of a research university’s federal funding — which arrives as grants, not procurement contracts — is squarely in scope.

References

• Section 889, John S. McCain National Defense Authorization Act for Fiscal Year 2019, Public Law 115-232.
• 2 CFR 200.216, Prohibition on certain telecommunications and video surveillance services or equipment (Uniform Guidance), effective August 13, 2020; unallowable-costs cross-reference at 2 CFR 200.471.
• FAR 52.204-24, 52.204-25, 52.204-26, 52.204-27 (contractor-side implementation).
• U.S. Election Assistance Commission, “What is Section 889 of the FY 2019 NDAA?,” eac.gov.