NDAA Section 889: banned cameras and access control gear in agency purchases

Reference article · 5 min read

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 is usually described as a federal contracting rule, but most state and local staff first meet it in a grant document. A county upgrading courthouse cameras or a city adding badge readers at a water plant can land inside the restriction, and the trigger is usually the federal money attached to the project.

The short answer for most readers: federal award funds generally cannot be used to buy video surveillance equipment produced by the entities Section 889 names, and the restriction follows the money down to subrecipients and their contractors. The longer answer is that identifying covered equipment is harder than reading a brand name off a box, because much of the affected hardware is sold under other labels.

What the restriction covers

Section 889 names specific entities rather than categories of technology, and it carries two prohibitions. The first bars covered agencies from procuring covered telecommunications equipment or services, or any system that uses such equipment as a substantial or essential component or as critical technology. The second bars contracting with an entity that uses covered equipment in its own operations, which reaches what a party uses, not only what it sells.

Huawei and ZTE, with their subsidiaries and affiliates, are covered for telecommunications equipment and services generally. Hytera, Hangzhou Hikvision Digital Technology, and Dahua Technology, with their subsidiaries and affiliates, are covered for video surveillance and telecommunications equipment used for purposes such as public safety, security of government facilities, and physical security surveillance of critical infrastructure. That reaches beyond cameras, to recorders, encoders, intercoms, some access control hardware, land mobile radios, and network gear inside a surveillance segment. Confirm current scope with your grantor or counsel, since the entity list and the implementing rules have been amended over time.

How it reaches state and local agencies

• Federal award terms. The Uniform Guidance prohibits recipients and subrecipients from using federal award funds to procure covered telecommunications equipment or services, and treats those costs as unallowable. This path catches most local purchases.
• Flow-down. A city receiving preparedness or transportation funds through a state administering agency inherits the term and must pass it to its own contractors and subrecipients.
• Direct contracts. Agencies performing under a federal prime contract or cooperative agreement also face the second prohibition, which reaches equipment they merely use.
• State law. Several states have enacted their own restrictions on these manufacturers, sometimes broader than the federal rule and not limited to federally funded purchases.
• A separate federal track. The Federal Communications Commission maintains its own covered list and has restricted new equipment authorizations for certain of these products. Different legal basis, and no substitute for the Section 889 analysis.

Why rebranding and embedded components are the trap

The covered manufacturers have long supplied white label hardware to other brands, so a camera carrying a familiar domestic-sounding label may be an unmodified covered product with rebranded firmware. Integrators rarely volunteer this unless asked in writing. Components are the second trap: a device built by a non-covered manufacturer may carry a chipset, module, or firmware stack from a covered entity. Whether that is a substantial or essential component is a legal determination, not a purchasing preference, so document what you find and route close calls to counsel.

How to verify what you are offered or already own

• Ask for the manufacturer, not the brand. Require the producing entity, model number, and country of manufacture for each line item.
• Look up the FCC ID. The grantee code portion maps to the applicant that certified the device, which often differs from the name on the housing.
• Check MAC address prefixes. The organizationally unique identifier on an installed device points to the hardware vendor.
• Inspect firmware and interfaces. Web interface strings, ONVIF device information fields, firmware file naming, default service ports, and the mobile app a vendor tells you to install all carry lineage.
• Reconcile records. Video management system device lists and fixed asset records, matched against purchase orders and funding source, build the inventory you will need anyway.

What to require from bidders and in the contract

1. A signed representation, per solicitation and per model, mirroring the federal representation language and stating that no offered item is covered equipment.
2. A bill of materials identified by producing manufacturer, with disclosure of any white label or original equipment manufacturer relationship.
3. Flow-down of the same representation to subcontractors, suppliers, and installers.
4. A continuing duty to notify the agency promptly if the vendor later learns that delivered equipment is covered.
5. Remedies that survive acceptance: rejection, removal and replacement at the vendor's cost, and termination rights.
6. Substitution control, so no model change or warranty replacement arrives outside the representation.
7. The same questions for hosted services, since covered equipment can sit behind a cloud video offering.

If an existing fleet turns out to be covered

Stop new purchases and stop charging related costs to federal awards while you sort it out. Tag each device in the inventory with its funding source, because obligations differ between a camera bought with local money and one bought with grant funds. Notify your grantor or pass-through entity and ask about allowability and remediation expectations rather than guessing.

Meanwhile, reduce exposure: isolate the devices on a separate network segment, remove internet access, disable peer to peer and universal plug and play features, and replace default credentials. Then sequence a replacement plan by risk and by which assets block future grant eligibility. At audit time, a documented and funded remediation plan is worth more than a clean assertion you cannot support.

HQT advises state and local agencies on technology procurement and systems engineering questions of this kind.

Frequently asked questions