Section 889 of the 2019 defense authorization act did something admirably blunt for a Washington statute; it named five Chinese companies (Huawei, ZTE, Hytera, Hikvision, Dahua) and told every federal agency to stop buying their gear, stop buying anything built on their gear, and stop contracting with anyone else who uses it. Six years on, a new GAO report says the ban worked, more or less. Federal spending with the five firms cratered after 2019 and hit zero in three of the last four fiscal years. Ninety percent of companies with active contracts now say they don’t touch the equipment.
Read past the highlights box, though, and this is less “mission accomplished” than “nobody bothered to look.”
Whoever They Say They Are
The entire enforcement mechanism rests on a checkbox. Contractors register with the government and represent, once a year, that they do or don’t use covered equipment. GSA and Defense Department contracting officers are explicitly authorized to take that representation at face value; GAO found neither agency’s officers “regularly check the accuracy of representations,” because policy tells them not to unless something independently raises a flag. Nobody audits the 90 percent who checked the good box. They’re just believed.
That might be defensible if the government at least knew who the banned companies actually were, corporately speaking. It doesn’t. The law also covers subsidiaries and affiliates, and identifying those is the entire ballgame; a contractor can’t truthfully represent compliance if it doesn’t know the vendor three tiers down its supply chain is secretly a Hikvision shell.
GSA has identified about 700 such entities using commercial “supply chain illumination” tools. GAO’s own prior work found the Air Force tested those same tools and got them 60 to 70 percent accurate, flagging risk where none existed and missing suppliers that did. The Defense Department doesn’t keep a subsidiary list at all. Officials said corporate structures change too fast for a list to stay useful, a fascinating argument for why the department shouldn’t try rather than why it should try harder.
The List Nobody Shared Until Somebody Was Watching
Here is the detail worth reading past the highlights page for. GSA built that list of 700 shell companies years ago. It never gave it to any other federal agency, not to the dozens also bound by Section 889, not through any of the information sharing channels Congress built for this exact purpose in the 2018 Federal Acquisition Supply Chain Security Act.
GSA and Defense didn’t reliably share the list even with each other. Both agencies told GAO they exchanged subsidiary information “occasionally” in the past, and only started meeting on it regularly after GAO began asking questions for this audit. One Defense official said the department is “looking to improve this process so that it is no longer ad hoc,” six years and one federal audit after the prohibition took effect.
Asked why the information hadn’t gone further, both agencies said the statute doesn’t require them to share it. True, and also the whole problem in one sentence; a compliance regime built on knowing which shell companies belong to a sanctioned Chinese firm produced exactly one usable master list across the federal government, and its owner sat on it until an outside auditor came knocking.
A Search Tool for Information That’s About to Stop Existing
The one piece of real infrastructure here, an automated tool GSA built with NASA’s help to search representations in real time, is about to get less useful. The administration’s “Revolutionary FAR Overhaul” plans to scrap the annual representation requirement and replace it with a single, one-time box check buried inside a company’s initial contract offer. GSA and Defense officials told GAO they’re worried purchase cardholders won’t be able to pull current compliance data on a given vendor once that happens; neither agency has worked out what to do about it.
The timing is not ideal. A parallel ban on certain Chinese magnets and metals takes effect in January 2027. A ban on Chinese semiconductors follows in December 2027. Both will demand exactly the subsidiary and supply chain visibility that Section 889 never quite produced, and that the government is now preparing to make harder to track, not easier.
The Actual Recommendation
GAO’s fix, delivered with its usual bloodless restraint, is that GSA and Defense should “periodically” share what they know with other agencies. Both concurred. GSA says it’s “working on a plan.” Defense says it will “assess the feasibility” of even collecting subsidiary data in the first place, then figure out later who to send it to.
Six years, one statute, five named companies, and the government’s best answer to “who actually owns these shell companies” is a plan to think about assessing feasibility. The equipment ban worked. The part where anyone checks whether it’s still working is, by both agencies’ own account, not required by law, and so it mostly hasn’t happened.
