Scope of this page
General information for Colorado property owners and procurement teams. It is not legal advice. Federal, state, local and contract requirements can differ; verify the current rule and the specific equipment before acting.
Section 889 of the 2019 NDAA, implemented in FAR Subpart 4.21, bars federal agencies from procuring equipment, systems, or services that use covered telecommunications gear as a substantial or essential component. Federal contractors also face limits on using that gear in covered work. It is not a general ban on private ownership, private sale, or installation in Colorado.
Section 889 comes up in almost every camera project that touches federal money, and it is usually described more broadly than the statute supports. The rule is real, the list of covered sources is short, and the obligation falls on the buyer and the contractor rather than on the equipment alone.
This page explains what the provision requires, which systems it reaches, and how a Colorado organization can screen existing equipment and new purchases without overstating the risk. It is general information, not legal advice; confirm your obligations with counsel and your procurement contact before you act on it.
Where Section 889 applies
Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 has two operative parts. Part A bars federal agencies from procuring, obtaining, extending, or renewing a contract for any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component, or as critical technology. Part B, effective in August 2020, bars agencies from entering into contracts with an entity that uses that equipment in the same way. Both parts were written for federal buying, not for the open market.
The Federal Acquisition Regulation implements both parts in Subpart 4.21, and clauses 52.204-24, 52.204-25, and 52.204-26 carry the representation, disclosure, and prohibition into individual contracts. When an award, subcontract, grant, or cooperative agreement includes those clauses, the restriction travels with the work even though the end user is not a federal agency. The clauses also ask an offeror to represent whether it uses covered equipment, so the question reaches suppliers and integrators, not only manufacturers. That representation is why a subcontractor with no federal contract of its own can still be asked to sign a disclosure.
Which equipment the rule covers
The statutory list is narrow. It names telecommunications and video surveillance equipment from Huawei, ZTE, Hytera, Hikvision, and Dahua, along with their subsidiaries and affiliates, plus telecommunications services and video surveillance services provided by those companies. A camera, recorder, radio, or switching component from one of those sources is covered equipment whenever it sits inside the system being bought. The name on the front of a housing is not a complete answer, because the covered part may be a module inside it. A question about where the firmware was written belongs in the same check.
The test is use, not brand preference. A covered camera that supplies video to a federal system can be a substantial or essential component, and so can an embedded module inside equipment sold under another name. Manufacturer bills of materials and written component statements matter more than model numbers, because the origin of the logic, the radio, and the firmware can sit several tiers below the badge on the housing. Ask for that statement in writing, signed by the manufacturer, and current.
What Section 889 does not require
Section 889 is a procurement and contracting restriction. It does not make it unlawful for a private business in Colorado to own, keep, or service covered equipment, and it does not order anyone to remove working devices from a privately funded network. A hotel, clinic, or warehouse that installed cameras before the rule took effect has not broken the law by leaving them in place. A blanket claim that these brands are banned is therefore misleading.
That narrower reading does not make the equipment risk-free. State procurement terms, grant and funding conditions, insurance requirements, and sector rules can all be stricter than the federal floor, and a single federal task order can pull an otherwise private system into scope. Contract language, not the brand name, usually decides which rules apply, and it is the first thing worth reading. A school district, hospital, or utility may already be covered by a rule of its own.
Screening equipment before you buy or renew
Start with the documents that govern the purchase: the contract, purchase order, grant agreement, or funding condition, and specifically any reference to FAR 4.21 or clauses 52.204-24 through 52.204-26. Ask the contracting officer or program contact whether the prohibition covers the whole system or only the components in the federal path, and record the answer in the project file so it survives staff changes.
Then inventory what is installed and what is proposed, down to embedded modules, and request written manufacturer statements, component listings, and FCC IDs where equipment authorization applies. For existing sites, segment covered devices onto restricted network zones while replacement is planned and funded, and stage the work so no federally funded system depends on covered gear. Confirm state, local, and critical-infrastructure requirements separately instead of treating the federal rule as the ceiling, and have counsel and procurement review the conclusion.
Sources
Frequently asked questions
Does Section 889 ban Hikvision and Dahua cameras in Colorado?
No. Section 889 restricts federal procurement and the use of covered equipment in federal contract work. It does not ban private ownership, private sale, or private installation in Colorado. A business can still buy and run that equipment unless a contract, funding condition, or state or local rule says otherwise.
Do existing cameras have to be removed?
The provision does not require removal of lawfully installed equipment from a privately funded site. Replacement is driven by contract terms, funding conditions, insurance, or your own risk decision. Where a federal system depends on the device, the practical move is to take it out of that path or replace it.
What documentation should a manufacturer provide?
Ask for a written statement that the product contains no covered equipment or services as a substantial or essential component, a component-level bill of materials, and the FCC ID where authorization applies. Keep those documents with the project file so a later review has evidence.
Last reviewed: