Summary

  • Section 889 bars federal purchases of covered telecommunications and video-surveillance equipment or services from five named companies and their subsidiaries or affiliates. A separate provision restricts contracts with entities that use covered equipment.
  • GSA said it had identified about 700 subsidiaries and affiliates by May 2026. GAO found GSA and DOD did not broadly distribute their supplier-lineage information or implementation practices to other agencies, though they had made limited exchanges.
  • GAO recommended periodic sharing by both agencies. They agreed. The practical test is a dated, maintained distribution record that a contracting officer can use and correct.

The rule is federal; the family tree is departmental

Congress put the five names into Section 889 of the fiscal-2019 National Defense Authorization Act. The restriction on agency procurement took effect in August 2019. In August 2020, a second restriction took effect for contracts with entities using covered equipment or services as a substantial or essential component or critical technology. Those are different checks. One asks what the government buys. The other asks what a contractor uses. Both require more than recognizing the logo on a box.

The Government Accountability Office's September 2026 audit found real machinery behind the ban. GSA uses automated checks to remove prohibited items from its Multiple Award Schedule. It and DOD provide contracting officers and purchase-card users ways to look up company representations in the System for Award Management. GSA and DOD were sensible audit subjects: together they accounted for nearly two-thirds of federal contract obligations in fiscal 2025, and GSA's schedules serve buyers throughout government.

Then comes the corporate tree. An agency may be offered a product through a distributor, integrator or subsidiary whose name does not match any of the five named companies. GSA officials told GAO that by May 2026 they had assembled a list of about 700 subsidiaries and affiliates. They used supply-chain visibility tools, search algorithms, origin tracing and alerts. They also said they had terminated contracts with entities they determined were subsidiaries in at least two cases. DOD used comparable methods and its own information, though it did not maintain a centralized list.

Seven hundred is a measure of one agency's assembled intelligence, not an official final census of every covered company. GAO describes the difficulty of identifying rebadged equipment and components buried in a supply chain. A company can also change ownership or names. What matters operationally is whether the buyer knows what a lineage claim rests on, when it was checked, and who can challenge or update it. A bare list handed over once would age into another trap.

A handoff that depends on being asked

GAO found that GSA and DOD did not broadly share their affiliate intelligence and lessons about applying Section 889 with other agencies. Officials explained that the law did not require them to. The departments had exchanged information with each other on an ad hoc basis; a DOD official said the department wanted a less ad hoc process. GSA said it had also given affiliate information to the Federal Acquisition Security Council in 2022 and 2025. GSA did not know whether the council's information-sharing agency, CISA, had then distributed it. The original GAO report records those paths, and the missing receipt at the end of them.

This is why the distinction between sending and distribution matters. An office can transfer a file to another federal body and still leave ordinary purchasing desks uncertain about the current evidence. The procurement officer evaluating an unfamiliar supplier needs a maintained reference at the decision point, not a rumor that someone elsewhere did the research. Access controls may be necessary for sensitive supplier intelligence. They make an audited route more important, not less.

Contractor declarations do useful work, but they answer a different question. GAO found that, as of March 2026, nearly 90% of companies with active federal contracts in fiscal 2025 publicly represented that they did not use covered equipment; about 2%, roughly 1,800, represented use. Those statements are representations. They are not an independent physical inventory of each contractor's network or every component it buys. A purchasing officer can check a representation and still need updated information about a supplier's corporate parent.

GAO made four recommendations that move the problem from institutional courtesy into routine work. GSA and DOD should periodically share information on subsidiaries and affiliates with other agencies and coordinate on the practices they have developed, using existing federal channels as appropriate. Both concurred. A periodic release should have a date, source basis, confidence or dispute status, correction route, intended recipients and acknowledgements. Its usefulness can be tested by taking a sample purchasing decision and reconstructing which version of the supplier evidence the decision maker saw.

The audit did not provide that end-to-end distribution proof.

The next rule is already approaching. The report notes a separate prohibition concerning certain Chinese semiconductors scheduled to begin in December 2027. The same problem of corporate lineage and embedded components can recur there. Washington has a chance to build a reusable information route before adding another forbidden product to an agency's checklist.

Sources: US GAO report page; GAO original full report.