Published: Sep 22, 2026. Publicly Released: Sep 22, 2026.
Fast Facts
The federal government depends on telecommunications and surveillance equipment to do its work. But there are concerns that buying certain foreign-made items could threaten U.S. national security. A 2019 law prohibits agencies from buying such equipment from five Chinese companies.
We looked at how DOD and the General Services Administration implemented the law and found they have processes to help ensure they don’t buy prohibited items. But they don’t share insights, like information about the five companies’ affiliates, that could help other agencies comply with existing and upcoming prohibitions.
Our recommendations address this.
Hooded figures in front of a Chinese flag; the one in the foreground is using a laptop computer.
Highlights
What GAO Found
Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 prohibits federal agencies from procuring covered telecommunications and surveillance equipment and services from five specific Chinese companies (and their affiliates or subsidiaries) or awarding contracts to companies that use such equipment and services. Following implementation in fiscal year 2019, agencies reduced spending with the five companies through fiscal year 2025 with no spending in three of those fiscal years. As of March 2026, GAO found that nearly 90 percent of companies with active government contracts in fiscal year 2025 represented publicly that they do not use equipment from these companies.
Federal Obligations to Five Identified Companies in Section 889 Prohibitions, Fiscal Years 2016-2025
Â
Note: Agencies could have used a waiver to make awards after 2019, which the statute permitted for a certain time.
The General Services Administration (GSA) and Department of Defense (DOD) have processes to help ensure they do not buy the prohibited equipment and services or contract with vendors that use such equipment and services. For example,
- GSA has automated processes to remove prohibited equipment and services on its Multiple Award Schedule contracts used by other agencies.
- DOD and GSA have search tools that contracting officers and purchase cardholders can use to determine how contractors represent their compliance with the prohibitions in the System for Award Management.
However, GSA and DOD do not broadly share their insights from implementing Section 889 prohibitions with other government agencies. This would include information about the five companiesâ subsidiaries and affiliates and methods the two agencies have used to enhance insight into the supply chain. For example, based on its experience with Section 889 prohibitions, GSA has plans to expand its use of customs data to identify the origin of goods, which GAO previously reported is difficult to do. By sharing information about their experience with current prohibitions, GSA and DOD could help other agencies address additional upcoming statutory prohibitions, such as on semiconductors. Sharing information could also help improve compliance.
Why GAO Did This Study
Concerns about the U.S. governmentâs reliance on Chinese companies for telecommunications and information technology have existed for more than a decade. Government agencies have reported concerns that government procurement of certain foreign-made items could facilitate cyberattacks, espionage, and threats to U.S. national security.
A House report asked GAO to report on implementation of Section 889 prohibitions. GAOâs report assesses, among other objectives, how selected agencies have taken actions to ensure compliance with the prohibitions and the extent to which these agencies are sharing information to improve their ability to implement prohibition efforts.
GAO identified GSA and DOD processes for ensuring compliance with prohibitions and analyzed federal procurement and System for Award Management data. GAO focused on DOD and GSA as they together account for nearly two-thirds of fiscal year 2025 contract obligations and GSA supports procurements across government agencies. GAO also interviewed GSA and DOD officials to obtain their perspectives on government efforts to comply with prohibitions.
Recommendations
GAO is making four recommendations, including that GSA and DOD periodically share subsidiary and affiliate information with other agencies, as well as practices that can inform future prohibition efforts. GSA and DOD concurred with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| General Services Administration | The Administrator of GSA should ensure that GSA periodically shares subsidiary and affiliate information it collects with relevant federal agencies, including leveraging the Cybersecurity and Infrastructure Security Agency’s existing mechanisms, as appropriate. (Recommendation 1) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Defense | The Secretary of Defense should ensure that DOD periodically shares subsidiary and affiliate information it collects with relevant federal agencies, including leveraging the Cybersecurity and Infrastructure Security Agency’s existing mechanisms, as appropriate. (Recommendation 2) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| General Services Administration | The Administrator of GSA should ensure that GSA coordinates with other federal agencies and leverages the Cybersecurity and Infrastructure Security Agency’s existing mechanisms, as appropriate, to share insights from its Section 889 implementation experience that could be used to inform agencies’ approaches for implementing Section 889 or future prohibition efforts. (Recommendation 3) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Defense | The Secretary of Defense should ensure that DOD coordinates with other federal agencies and leverages the Cybersecurity and Infrastructure Security Agency’s existing mechanisms, as appropriate, to share insights from its Section 889 implementation experience that could be used to inform agencies’ approaches for implementing Section 889 or future prohibition efforts. (Recommendation 4) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
Full Report
GAO Contacts
Public Inquiries
Topics
Source: Reports News from the GAO
