Overview
On June 2, 2023, a new Federal Acquisition Regulation (FAR) rule, implementing the No TikTok on Government Devices Act, was published in the Federal Register effective immediately. Under the interim rule, government contractors (and subcontractors) are prohibited from having or using the TikTok application (or any successor application or service provided by ByteDance Limited) on any information technology (IT) owned or managed by the Government, or IT used or provided by a contractor under a government contract. This prohibition includes equipment, such as cell phones or tablets, provided by the contractor’s employees that are used to perform a government contract, such as those used as part of an employer’s bring your own device (BYOD) program. Contractors should be aware that this clause will be inserted into new solicitations, modifications to existing contracts, and future orders under indefinite delivery contracts and extends to contracts for commercial and commercially available off-the-shelf items.
* * * * * *
The interim rule implements a section of the Consolidated Appropriations Act of 2023 and Office of Management and Budget Memorandum M-23-13 prohibiting TikTok on Government devices. Specifically, the interim rule amends FAR Part 4 and adds a new contract clause, FAR 52.204-27, Prohibition on a ByteDance Covered Application. The new clause prohibits contractors from "having or using" TikTok on any IT owned or managed by the Government, or on any IT used or provided by the contractor.
The rule adopts the statutory definition of "information technology," at 40 U.S.C. § 11101(6), rather than the definition of information technology in FAR 2.101. Under the statutory definition, information technology includes:
(1) “any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use— (i) Of that equipment; or (ii) Of that equipment to a significant extent in the performance of a service or the furnishing of a product; and
(2) “computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources."
Accordingly, the interim rule includes an expansive scope that sweeps in employee's IT equipment, such as employee cell phones or tablets, if "used in the performance of the contract." OMB Memorandum M-23-13 originally appeared to provide more limited guidance on contractor devices, only extending the new prohibition to IT required to be used in a contract either expressly or "to a significant extent in performance of a service or furnishing of a product." However, the interim rule covers IT "used in the performance of a contract” and does not define this standard. Under an expansive (but reasonable) interpretation, if an employee uses an employee-owned device to transmit communications about or documents related to a contract (via calls, texts, or emails), then that device would be subject to the restriction. Without further clarity, it is also possible that internal departments supporting contract performance such as accounting or human resources may also be swept under the rule as these functions are part of the performance of a contract. We anticipate that the final rule may provide additional clarity to identify which employee devices may be considered to be “used in performance” of the contract.
Further, based on the FAR Council’s assessment that the presence or use of TikTok on covered IT poses "an unacceptable level of risk" to national security, the clause broadly applies to most government contractors. The clause will be included in contracts at or below the Simplified Acquisition Threshold (currently $250,000), contracts for commercial products and commercial services, including commercially available Off-The-Shelf items, and contracts with small businesses. Prime contractors must also flow down the clause to subcontractors.
Limited exceptions to the rule for a specific agency program or operational action are available for law enforcement activities, national security interest and activities, and security research. As identified in OMB Memorandum M-23-13, exceptions must be granted by an agency head or their designee, and are limited to one-year periods.
Comments on the interim rule may be submitted prior to August 1, 2023.
