What Are the Two Exceptions to Section 889?

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 has exactly two exceptions to its ban on covered telecommunications equipment and services, and both are set out in FAR 52.204-25(c). The first covers services that connect to a third party’s facilities through backhaul, roaming, or interconnection. The second covers telecommunications equipment that cannot route or redirect user data and cannot see inside the data it handles. If neither fits, the prohibition applies, and the only remaining relief is a waiver from the Director of National Intelligence.

Exception One: Services That Connect to a Third Party’s Facilities

FAR 52.204-25(c)(1) allows a contractor to provide a service that connects to the facilities of a third party through backhaul, roaming, or interconnection arrangements.¹ Each of those terms describes a specific network arrangement:

Backhaul is the transport of traffic between a base station and a central hub.
Roaming lets a mobile user stay connected outside their primary service area.
Interconnection is the physical linking of different providers’ networks so traffic can pass between them.

The exception exists because modern telecommunications networks are deeply interconnected. A contractor’s service may inevitably cross infrastructure owned by a prohibited entity when traffic moves across shared networks. So long as the contractor is providing a connection service to a third party’s facilities, rather than supplying a prohibited entity’s equipment itself, this carve-out applies. The regulation attaches no additional data-handling condition to this exception.¹

Exception Two: Equipment That Cannot Access User Data

FAR 52.204-25(c)(2) covers telecommunications equipment that cannot route or redirect user data traffic and does not permit visibility into any user data or packets the equipment transmits or handles.¹ The equipment has to meet both conditions. It cannot redirect traffic, and it cannot see the contents of data passing through it.

In practice, this describes equipment that acts only as a passive conduit. It moves data from one point to another without any ability to inspect, analyze, or reroute what it carries. A power supply, a physical mounting bracket, or a passive antenna element with no firmware capable of reaching data streams would typically qualify. Equipment that performs switching, routing, authentication, or packet inspection would not, because those functions give the hardware the ability to interact with user data.

The Video Surveillance Boundary

This second exception is written for telecommunications equipment. It does not extend the same functional test to video surveillance equipment, which remains prohibited if it comes from a covered entity regardless of what the hardware can or cannot do with data.² A covered surveillance camera cannot be redeemed by arguing that its firmware is limited. That path is closed.

When Neither Exception Applies

If a contractor’s situation does not fit either carve-out, the only remaining relief is a waiver, and the options have narrowed. The statute originally let the head of an executive agency grant a one-time, case-by-case waiver. That authority expired on August 13, 2021 for the Part A procurement prohibition and on August 13, 2022 for the Part B use prohibition, with no renewal mechanism built in.³

The Director of National Intelligence holds a separate waiver authority that has no statutory expiration date. The DNI may grant a waiver on a determination that doing so is in the national security interests of the United States.⁴ Because the agency head waivers have expired, DNI waiver is now the only waiver mechanism for Section 889.

For emergencies, including major disaster declarations, the normal steps of consulting the Office of the Director of National Intelligence and notifying the Federal Acquisition Security Council before granting a waiver can be bypassed if those steps would severely jeopardize mission-critical functions. The agency head has to determine that prior notice and consultation are impracticable due to the emergency, then notify ODNI and the FASC within 30 days of award.³ This flexibility was tied to the original agency head waiver authority and its expired timeline.

Reading the Exceptions Together

Taken together, the two exceptions divide neatly. The first is about the shape of a service — a contractor is permitted to hand traffic off to a third party’s network even when that network contains prohibited equipment. The second is about the capability of a device — a piece of telecommunications hardware is permitted if it is functionally blind and cannot steer traffic. Anything else, including any video surveillance product from a covered entity, remains prohibited unless the DNI issues a waiver.