Section 889 is short, widely misquoted, and expensive to get wrong. It is not a ban on Chinese cameras, it is not a security certification, and it does not apply only to federal agencies. Here is what it says, how it reaches an ordinary purchase order, and the one question worth asking before a box ships.
What the law actually says
Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 contains two separate prohibitions, and they took effect a year apart.
- Part (a)(1)(A) — the procurement prohibition. Executive agencies may not procure, or obtain, covered telecommunications equipment or services as a substantial or essential component of any system. This took effect in August 2019.
- Part (a)(1)(B) — the use prohibition. Executive agencies may not enter into, extend or renew a contract with an entity that uses covered equipment or services as a substantial or essential component of any system — whether or not that use has anything to do with the federal contract. This took effect in August 2020.
The second one is the one that surprises people. It reaches into your own building. A contractor bidding federal work has to consider equipment installed at its own facilities, not merely what it proposes to supply. That is why the question “do you have any of this on site?” turns up in due diligence long before a government camera is ever specified.
Who is named
The statute names specific companies rather than a country. For telecommunications equipment it names Huawei Technologies Company and ZTE Corporation. For video surveillance and telecommunications equipment used for public safety, security of government facilities, physical security surveillance of critical infrastructure and other national security purposes, it names Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company and Dahua Technology Company. In each case the prohibition extends to subsidiaries and affiliates of those entities, and it also covers certain services provided by entities that a relevant agency reasonably believes to be controlled by or connected to the government of a covered foreign country.
Two clarifications that save arguments. First, “made in China” is not the test; the test is the named entities and their subsidiaries and affiliates. Plenty of compliant equipment is manufactured in China, and some non-compliant equipment is assembled elsewhere. Second, the prohibition attaches to the equipment being a substantial or essential component — which in practice means that hunting for a compliant camera whose obscure sub-component originated somewhere is not the exercise. Identifying the manufacturer of the device is.
How it reaches your purchase order
The Federal Acquisition Regulation implements Section 889 through a small set of clauses that you will see quoted in solicitations and flowed down through subcontracts:
- FAR 52.204-24 — the representation regarding covered telecommunications equipment or services, made as part of an offer.
- FAR 52.204-25 — the prohibition clause itself, including the flow-down obligation to subcontractors at all tiers.
- FAR 52.204-26 — the covered telecommunications equipment representation associated with annual representations and certifications.
Because 52.204-25 flows down, the obligation does not stop at the prime. A supplier two tiers removed from the government can find the clause in their purchase order, and the representation they signed is the document that gets produced if anything goes wrong. Read what you sign; a representation made carelessly is still a representation.
One more practical note: the exact clause set, and the way an agency handles waivers or exceptions, varies by solicitation and has changed over time. Read the clauses as they appear in your solicitation rather than relying on a summary — including this one.
The relabelling problem
This is where real projects come unstuck. Video surveillance hardware is extensively white-labelled: a manufacturer builds a camera, and it is sold under several other brands, sometimes in different markets, sometimes with a different housing and firmware and nothing else changed. The name on the bezel is not reliable evidence of who designed and built the board inside.
That has two consequences. Buying a brand you have not verified is not a defence. And a product line you cleared three years ago can change its underlying manufacturer without changing its model number — ownership changes, contract manufacturers change, and a supplier who was compliant at last purchase may not be at this one.
The test that works is boring and effective: ask the supplier, in writing, to state the manufacturer of the equipment offered and to confirm that neither it nor any covered entity is the producer. Get it before the order, not after delivery. A compliance problem discovered on the dock is a return; a compliance problem discovered after installation is a rip-and-replace conversation with your customer, and a very uncomfortable one if the system is already recording.
What to do before anything ships
- Decide whether you are in scope at all. Any federal contract, grant or agreement touching your organisation makes the question live. If you are unsure, assume you are in scope and check.
- Read the clauses in your actual solicitation, including the ones incorporated by reference that nobody prints.
- Ask every supplier who manufactured the product, in writing, per model number, per order. Keep the answer.
- Audit what you already own. The use prohibition looks at your existing estate, and existing estates contain relabelled hardware nobody remembers buying. Our system audit checklist includes this line for exactly that reason.
- Write it into the specification, not just the purchase order. A requirement in the contract documents survives a substitution; a requirement in an email does not.
- Plan replacement rather than discovering it. If you find covered equipment, a phased replacement with a written plan is a far better position than a surprise during a contract review.
And a word on what Section 889 is not. It is not a quality assessment, and compliance with it says nothing about whether a camera is secure. Default passwords, unpatched firmware and devices exposed straight to the internet remain the dominant real-world risk in video systems regardless of who built them — see cyber hygiene for cameras. Compliance keeps you eligible to hold the contract. Hygiene keeps the system from being the way in.
None of the above is legal advice, and the rules around federal supply chain restrictions continue to develop. If a contract turns on it, put the question to your contracting officer or your counsel — and get the supplier’s answer in writing either way.
Who wrote this, and what we sell. LA CCTV Supply provides security consulting and system design, sells the equipment and trains your people. We are not an installing contractor: installation is performed by your licensed contractor, except for small non-permitted work under $1,000 all-inclusive, which we can handle directly.
Nothing above is legal, code or accreditation advice. Requirements for your project are set by your Authority Having Jurisdiction, your engineer of record, your contracting officer or your Accrediting Official — and where a figure depends on your building, we have said so rather than inventing one.