Holland & Knight previously noted an Office of Management and Budget (OMB) memorandum prohibiting the use of TikTok on information technology used by federal agencies and contractors. (See Holland & Knight's previous blog post, "Government Contracts Face an Immediate Deadline to Delete TikTok from Some IT," March 28, 2023.) The authors also discussed the immediate ramifications applicable to government contractors and steps contractors could take to ensure they were prepared to implement requirements that would soon apply to them.
The Federal Acquisition Regulatory Council (FAR Council) recently issued an interim rule, FAR 52.204-27, which implements the OMB's guidance and expands the reach of the previous prohibition. This Holland & Knight alert outlines the interim rule and discusses how contractors will need to direct their employees to remove TikTok from any personal devices that are used in contract performance.
Recap: OMB Directive to Federal Agencies and Contractors
On Feb. 28, 2023, the White House issued a memorandum requiring the removal of TikTok1 from federal information technology, fulfilling the requirement set forth in the Consolidated Appropriations Act.
The OMB directive had important implications for government contractors, as the memo applied to all "information technology," as that term is defined in 40 U.S.C.§ 11101(6). This covered not only information technology (IT) owned or operated by federal agencies, but also to IT "used by a contractor under a contract with the executive agency that requires the use" of that IT, whether expressly or "to a significant extent in the performance of a service or the furnishing of a product." (emphasis added)
This definition does not "include any equipment acquired by a federal contractor incidental to a federal contract." The OMB directive provided no detail on this point, although the authors opined that the prohibition would not apply to IT that is reasonably necessary to a contractor's business, but only incidental to the performance of its government contract such as payroll, financial management and human resources systems, especially if those systems did not interconnect with any federal information systems.2
In other words, the OMB memo covered IT owned or operated by federal agencies, as well as any IT used by a contractor under a contract where the agency requires the use of that IT, either expressly or to a significant extent.
The New Interim Rule
On June 2, 2023, the FAR Council published an interim rule to implement the OMB directive.
Carried out by FAR 52.204-27, the interim rule is effective immediately. Contracting officers are required to include FAR 52.204-27 in any solicitations, awards, modifications, exercise of options or extensions on or after June 2, 2023. Existing indefinite delivery, indefinite quantity (IDIQ) contracts must be amended by July 3, 2023, so that the new clause will apply to future orders.
FAR 52.204-27 contains largely the same definitions as set forth in the OMB directive. However, the prohibition itself is more broad. It provides:
Prohibition. Section 102 of Division R of the Consolidated Appropriations Act, 2023 (Pub. L. 117-328), the No TikTok on Government Devices Act, and its implementing guidance under Office of Management and Budget (OMB) Memorandum M-23-13, dated February 27, 2023, "No TikTok on Government Devices" Implementation Guidance, collectively prohibit the presence or use of a covered application on executive agency information technology, including certain equipment used by Federal contractors. The Contractor is prohibited from having or using a covered application on any information technology owned or managed by the Government, or on any information technology used or provided by the Contractor under this contract, including equipment provided by the Contractor's employees …
FAR 52.204-27(b) (emphasis added)
Although the clause purports to merely implement the OMB directive and the No TikTok on Government Devices Act, the prohibition of TikTok on any IT "used or provided by the Contractor" goes further than either of these authorities.3 Regarding contractor IT, the OMB directive only covered IT that was used "to a significant extent in the performance of a service or the furnishing of a product." Now, based on the interim rule, the prohibition covers IT that is used to any extent by the contractor under a contract. Thus, it is no longer a question of how much private IT is being used in the performance of a government contract, but merely whether private IT is being used at all in performance.
This new language indicates that all contractor IT that is involved with a federal contract is included with the prohibition. Said another way, what IT could be "acquired by a Federal contractor incidental to a Federal contract," (equipment which the clause states is excluded from the prohibition"), yet not be "used or provided by the Contractor." In this way, FAR 52.204-27(a)(3) and FAR 52.204-27(b) are contradictory. The FAR Council should consider deleting or revising one of the following phrases:
- "Does not include any equipment acquired by a Federal contractor incidental to a Federal contract."
- "prohibited from having or using a covered application on … any information technology used or provided by the Contractor under this contract …"
The new language also very clearly extends the TikTok prohibition to the personal devices of company employees. While neither the OMB directive nor the No TikTok on Government Devices Act mentioned contractor employees' personal IT, FAR 52.204-27(b) expressly includes "equipment provided by the Contractor's employees" under the prohibition. The Federal Register notice echoes this, providing the following guidance on personal devices:
This prohibition applies to devices regardless of whether the device is owned by the Government, the contractor, or the contractor's employees (e.g., employee-owned devices that are used as part of an employer bring your own device (BYOD) program). A personally-owned cell phone that is not used in the performance of the contract is not subject to the prohibition.
88 FR 36430, 36430 (emphasis added)
While it is clear that FAR 52.204-27(b) includes personal devices under the prohibition, how can a company discern when a personal device crosses the line into being used on a contract?
What if Employees Only Use Their Personal Cell Phones for Email?
Client inquiries often follow a common fact pattern, asking:
We do not issue cell phones to employees. However, we allow them to access email and business messaging (i.e. Microsoft Teams, Slack) from their personal cell phones. Do we need to require employees to delete TikTok off their personal cell phone, even if it the only time the phone is used for contract performance is to access email or Teams?
The answer to this question is a firm "Yes." Pursuant to the language of FAR 52.204-27, if a contractor's employees are using their personal cell phones to email, Teams message, text message or even talk in relation to a federal contract, then those personal cell phones are apparently subject to FAR 52.204-27's prohibition.
The only personal devices not subject to the TikTok prohibition would be those devices that are not used at all in contract performance. Thus, if a contractor communicates with an employee via that employee's personal cell phone to discuss a federal contract, that cell phone would fall under the TikTok prohibition.
Final Takeaways
To make sure they are compliant with FAR 52.204-27, government contractors should take the following actions:
- Remove TikTok from all contractor IT.
- Direct employees using personal devices for contract work to uninstall TikTok from such devices. As a best practice, companies should provide guidance to employees on how to remove the program.
- Identify all devices used in performance of government contracts, including contractor and employee personal devices.
- Consult IT professionals on technical solutions to ensure compliance with the above.
- Once FAR 52.204-27 is added to existing contracts, contractors should ensure that they flow down this clause to their subcontractors.
Public comments on the interim rule can be submitted until Aug. 1, 2023. To the extent a company takes issue with any of the above requirements, it should consider submitting a comment4 to the Regulatory Secretariat Division to voice its concerns.
Notes
1 The "covered application" being banned is defined as "the social networking service TikTok or any successor application or service of TikTok developed or provided by ByteDance Limited or an entity owned by ByteDance Limited."
2 This view is consistent with that expressed in 40 U.S.C. 11101, U.S. Department of Defense Instruction 5000.82, Acquisition of Information Technology, and OMB's 2012 Memo (M-12-20) providing reporting instructions under the Federal Information Security Management Act (FISMA).
3 Neither the No TikTok on Government Devices Act nor OMB's "No TikTok on Government Devices" Implementation Guidance Memorandum contain the language "information technology used or provided by the Contractor."
4 The process for submitting comments is described under the "Comment Date" and "Addresses" headings.
