Last Friday, the Federal Acquisition Regulatory Council published an interim final rule ("IFR") to ban the use of a ByteDance Covered Application (i.e., TikTok) in government contracting.
The IFR is effective June 2, 2023.
The IFR introduces a new rule, Federal Acquisition Regulation ("FAR") 52.204–27, which "prohibits contractors from having or using a covered application on any information technology owned or managed by the Government, or on any information technology used or provided by the contractor under a contract, including equipment provided by the contractor's employees.”
Under the new IFR, contractors are required to flow down this clause to subcontractors, including subcontracts for commercial products or commercial services.
The IFR states that the prohibition applies to:
- All solicitations issued on or after June 2, 2023;
- For solicitations before June 2, 2023, provided the award of the resulting contract(s) occurs on or after the effective date.
- For existing indefinite-delivery contracts only, contracting officers shall modify them to include FAR 52.204–27 by July 3, 2023, to apply to future orders.
- If exercising an option or modifying an existing contract or task, or delivery order to extend the period of performance, contracting officers shall include FAR 52.204–27.
The IFR also is broad and covers virtually all types of government contracts:
- as noted above, task and delivery orders
- contracts under the simplified acquisition threshold ("SAT")
- contracts for commercial products and commercial services
- contracts for commercially available off-the-shelf ("COTS") items
Notably, the IFR notes that the prohibition doesn't just apply to government devices. The IFR also "applies to devices regardless of whether the device is owned by the Government, the contractor, or the contractor's employees (e.g., employee-owned devices that are used as part of an employer bring your own device (BYOD) program)." With that being said, the IFR does include a carve-out for a personal cell phone that is not used in the performance of the contract.
Because the rule was issued as an IFR, interested parties should submit written comments before August 1, 2023, to be considered in the formation of the final rule.
Takeaway
As shown above and in the IFR, the government views TikTok as a national security threat and is using this new rule to protect "government information and information and communication technology systems." Because the rule applies across a host of contracts and is required to be flowed down to subcontractors, primes should take heed and work swiftly to create a new compliance process related to TikTok and other ByteDance applications. Compliance efforts should not be taken lightly, even though the IFR does not include any reporting or record-keeping requirements and does not require contractors to review their supply chains.
