Source: http://federal.elaws.us/fr/notice/83-fr-28145
Timestamp: 2019-06-18 04:37:22
Document Index: 351457747

Matched Legal Cases: ['art 4', 'art 4', 'art 13', 'arts 1', 'arts 1', 'arts 1', 'art 4']

2018-12847. Federal Acquisition Regulation; Use of Products and Services of Kaspersky Lab, Federal Register
Home » 2018 Issues » 83 FR (06/15/2018) » 2018-12847. Federal Acquisition Regulation; Use of Products and Services of Kaspersky Lab
2018-12847. Federal Acquisition Regulation; Use of Products and Services of Kaspersky Lab
Start Preamble Start Printed Page 28141
• Contracting officers shall include the clause at FAR 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab or Other Covered Entities—
• In solicitations issued on or after July 16, 2018, and resultant contracts; and
• In solicitations issued before July 16, 2018, provided award of the resulting contract(s) occurs on or after July 16, 2018.
Contracting officers shall modify, in accordance with FAR 1.108(d)(3), existing indefinite-delivery contracts to include the FAR clause for future orders, prior to placing any further orders on or after July 16, 2018.
If modifying an existing contract to extend the period of performance by more than 6 months, contracting officers should include the clause in accordance with 1.108(d).
Comment Date: Interested parties should submit written comments to the Regulatory Secretariat on or before August 14, 2018 to be considered in the formulation of a final rule.
Submit comments identified by FAC 2005-99, FAR Case 2018-010, by any of the following methods:
Regulations.gov: http://www.regulations.gov. Submit comments via the Federal eRulemaking portal by searching for “FAR Case 2018-010”. Select the link “Submit a Comment” that corresponds with “FAR Case 2018-010.” Follow the instructions provided at the “Submit a Comment” screen. Please include your name, company name (if any), and “FAR Case 2018-010” on your attached document.
Mail: General Services Administration, Regulatory Secretariat (MVCB), ATTN: Lois Mandell, 1800 F Street NW, 2nd Floor, Washington, DC 20405-0001.
Instructions: Please submit comments only and cite FAC 2005-99, FAR Case 2018-010, in all correspondence related to this case. All comments received will be posted without change to http://www.regulations.gov, including any personal and/or business confidential information provided.
Ms. Camara Francis, Procurement Analyst, at 202-550-0935, for clarification of content. For information pertaining to status or publication schedules, contact the Regulatory Secretariat at 202-501-4755. Please cite FAC 2005-99, FAR Case 2018-010.
This interim rule revises the FAR to implement section 1634 of Division A of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2018 (Pub. L. 115-91). Section 1634 of this law prohibits the use of hardware, software, and services of Kaspersky Lab and its related entities by the Federal Government on or after October 1, 2018.
Implementation of this rule in the FAR should not impact or impair any other planned or ongoing efforts agencies may undertake to implement section 1634 of Division A of the NDAA for FY 2018, including consideration by agencies of the presence of hardware, software, or services developed or provided by Kaspersky Lab as a technical evaluation factor in the source selection process.
This rule amends FAR part 4, adding a new subpart 4.20, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab, with a corresponding new contract clause at 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities. The rule also adds text in subpart 13.2, Actions at or Below the Micro-Purchase Threshold, to address section 1634 with regard to micro-purchases.
To implement section 1634, the clause at 52.204-23 prohibits contractors from providing any hardware, software, or services developed or provided by Kaspersky Lab or its related entities, or using any such hardware, software, or services in the development of data or deliverables first produced in the performance of the contract. The contractor must also report any such hardware, software, or services discovered during contract performance; this requirement flows down to subcontractors. For clarity, the rule defines “covered entity” and “covered article.” A covered entity includes the entities described in section 1634. A covered article includes hardware, software, or services that the Federal Government will use on or after October 1, 2018.
As the Government considers additional actions to implement section 1634, DoD, GSA, and NASA especially welcome input on steps that the Government could take to better identify and reduce the burden on contractors related to identifying covered articles. For example:
Is the prohibition scoped appropriately to protect the Government by including situations in which covered articles may be used in the development of data or deliverables first produced during contract performance, for example, under a systems development contract?
Are the Government's analysis and estimates in sections VI and VII, including the estimate that 5 percent of contractors would be required to submit reports in accordance with the clause, reasonable? How could these estimates be improved?
If the Government were to consider establishing a list to publicly share information regarding products identified as meeting the definition of a covered article (i.e., excluded products), including those offered by third parties:
• What protocols should the Government apply prior to placing a product on the excluded list (e.g., who should be reaching out, and to whom)?
• Should different protocols apply depending on whether the product is made by the original equipment manufacturer, sold by a reseller, or customized by a firm?
• When is it appropriate to leave a product on the excluded list indefinitely (e.g., to provide notice for those who have previously acquired the product)?
• Are there steps that the Government can take to avoid inappropriately affecting the producer's interests (e.g., allowing the firm to demonstrate that there is a new version Start Printed Page 28142of the product that is free from concern and annotating the list accordingly)?
This rule adds a new contract clause at 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities, in order to implement section 1634 of the NDAA for FY 2018. Section 1634 of this law prohibits the use of hardware, software, and services developed or provided by Kaspersky Lab and related entities by the Federal Government on or after October 1, 2018.
41 U.S.C. 1905 governs the applicability of laws to acquisitions at or below the simplified acquisition threshold (SAT). Section 1905 generally limits the applicability of new laws when agencies are making acquisitions at or below the SAT, but provides that such acquisitions will not be exempt from a provision of law if: (i) The law contains criminal or civil penalties; (ii) the law specifically refers to 41 U.S.C. 1905 and states that the law applies to contracts and subcontracts in amounts not greater than the SAT; or (iii) the FAR Council makes a written determination and finding that it would not be in the best interest of the Federal Government to exempt contracts and subcontracts in amounts not greater than the SAT from the provision of law.
41 U.S.C. 1906 governs the applicability of laws to contracts for the acquisition of commercial items, and is intended to limit the applicability of laws to contracts for the acquisition of commercial items. Section 1906 provides that if a provision of law contains criminal or civil penalties, or if the FAR Council makes a written determination that it is not in the best interest of the Federal Government to exempt commercial item contracts, the provision of law will apply to contracts for the acquisition of commercial items.
Finally, 41 U.S.C. 1907 states that acquisitions of commercially available off-the-shelf (COTS) items will be exempt from a provision of law unless the law (i) contains criminal or civil penalties; (ii) specifically refers to 41 U.S.C. 1907 and states that the law applies to acquisitions of COTS items; (iii) concerns authorities or responsibilities under the Small Business Act (15 U.S.C. 644) or bid protest procedures developed under the authority of 31 U.S.C. 3551 et seq., 10 U.S.C. 2305(e) and (f), or 41 U.S.C. 3706 and 3707; or (iv) the Administrator for Federal Procurement Policy makes a written determination and finding that it would not be in the best interest of the Federal Government to exempt contracts for the procurement of COTS items from the provision of law.
The FAR Council has determined that it is in the best interest of the Government to apply the rule to contracts at or below the SAT and for the acquisition of commercial items. The Administrator for Federal Procurement Policy has determined that it is in the best interest of the Government to apply this rule to contracts for the acquisition of COTS items.
While the law does not specifically address acquisitions of commercial items, including COTS items, there is an unacceptable level of risk for the Government in buying hardware, software, or services developed or provided in whole or in part by Kaspersky Lab. This level of risk is not alleviated by the fact that the item being acquired has been sold or offered for sale to the general public, either in the same form or a modified form as sold to the Government (i.e., that it is a commercial item or COTS item), nor by the small size of the purchase (i.e., at or below the SAT). As a result, agencies may face increased exposure for violating the law and unknowingly acquiring a covered article absent coverage of these types of acquisitions by this rule.
Executive Orders (E.O.s) 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule has been designated a “significant regulatory action” under Executive Order 12866. Accordingly, the Office of Management and Budget (OMB) has reviewed this rule. This rule is not a major rule under 5 U.S.C. 804.
This rule is not subject to the requirements of E.O. 13771 because the rule is issued with respect to a national security function of the United States.
The change may have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act 5 U.S.C. 601 et seq. The Initial Regulatory Flexibility Analysis (IRFA) is summarized as follows:
The objective of the rule is to prescribe appropriate policies and procedures to enable agencies to determine and ensure that they are not purchasing products and services of Kaspersky Lab and its related entities for use by the Government on or after October 1, 2018. The legal basis for the rule is section 1634 of the NDAA for FY 2018, which prohibits Government use of such products on or after that date.
Data from the Federal Procurement Data System (FPDS) for FY 2017 has been used as the basis for estimating the number of contractors that may be affected by this rule. Approximately 97,632 unique entities received new awards in Fiscal Year (FY) 2017. Of these entities, 72,447 (74 percent) unique small entities received awards during 2017. It is estimated that the reports required by this rule will be submitted by 5 percent of contractors, or 3,623 small entities.
The rule requires contractors and subcontractors that are subject to the clause to report to the contracting officer, or for DoD, to the website listed in the clause, any discovery of a covered article during the course of contract performance.
Because of the nature of the prohibition enacted by section 1634, it is not possible to establish different compliance or reporting requirements or timetables that take into account the resources available to small entities or to exempt small entities from coverage of the rule, or any part thereof. DoD, GSA, and NASA were unable to identify any alternatives that would reduce the burden on small entities and still meet the objectives of section 1634.
DoD, GSA, and NASA will also consider comments from small entities concerning the existing regulations in subparts affected by this rule in accordance with 5 U.S.C. 610. Interested Start Printed Page 28143parties must submit such comments separately and should cite 5 U.S.C. 610 (FAR Case 2018-010) in correspondence.
DoD, GSA, and NASA requested and OMB authorized emergency processing of an information collection involved in this rule, as OMB Control Number 9000-0197, consistent with 5 CFR 1320.13. DoD, GSA, and NASA have determined the following conditions have been met:
a. The collection of information is needed prior to the expiration of time periods normally associated with a routine submission for review under the provisions of the Paperwork Reduction Act, in view of the deadline for this provision of the NDAA which was signed into law in December 2017 and requires action before the prohibition goes into effect on October 1, 2018.
b. The collection of information is essential to the mission of the agencies to ensure the Federal Government does not purchase prohibited articles, and can respond appropriately if any such articles are not identified until after delivery or use.
Passage of the omnibus appropriations bill and the availability of additional funding for FY 18 has increased agency purchasing activity, and the information to be collected is necessary to ensure that this purchasing is done responsibly and consistent with national security.
Moreover, DoD, GSA, and NASA cannot comply with the normal clearance procedures because public harm is reasonably likely to result if current clearance procedures are followed. Not only would agencies be more likely to purchase and install prohibited items, but even if such items were identified prior to the October 1 date, agencies would incur substantial additional costs replacing such items, as well as additional administrative costs for reprocurement.
DoD, GSA, and NASA intend to provide separate 60-day notice in the Federal Register requesting public comment on the information collection contained within this rule.
Title of Collection: Use of Products and Services of Kaspersky Lab.
Total Estimated Number of Respondents: 4,882.
Total Estimated Number of Responses: 24,410.
Total Annual Time Burden: 36,615.
OMB Control Number: 9000-0197.
The subsequent 60-day notice published by DoD, GSA, and NASA will invite public comments.
A determination has been made under the authority of the Secretary of Defense (DoD), Administrator of General Services (GSA), and the Administrator of the National Aeronautics and Space Administration (NASA) that urgent and compelling reasons exist to promulgate this interim rule without prior opportunity for public comment. It is critical that the FAR is immediately revised to include the requirements of the law, which prohibits the Federal Government from using hardware, software, or services of Kaspersky Lab and its related entities on or after October 1, 2018.
Although this prohibition does not apply until October 1, 2018, agencies and contractors must begin to take steps immediately to meet this deadline. In this regard, covered articles include hardware, software, and services acquired before October 1, 2018, that the Federal Government will use on or after October 1, 2018. Because so many IT products and services are used for more than a few months, it is critical that contractors be placed on notice as soon as possible of this prohibition so that agencies can ensure that they comply with the law and avoid acquisitions of covered articles that the Government will continue to use on or after October 1, 2018. Pursuant to 41 U.S.C. 1707 and FAR 1.501-3(b), DoD, GSA, and NASA will consider public comments received in response to this interim rule in the formation of the final rule.
List of Subject in 48 CFR Parts 1, 4, 13, 39, and 52
Therefore, DoD, GSA, and NASA amend 48 CFR parts 1, 4, 13, 39, and 52 as set forth below:
1. The authority citation for 48 CFR parts 1, 4, 13, 39, and 52 continues to read as follows:
2. Amend section 1.106 by adding to the table, in numerical sequence, FAR segment “52.204-23” and its corresponding OMB control number “9000-0197”.
3. Add subpart 4.20 to read as follows:
Covered entity means—Start Printed Page 28144
4. Amend section 13.201 by adding paragraph (i) to read as follows:
6. Add section 52.204-23 to read as follows:
(c) Reporting requirement. (1) In the event the Contractor identifies a covered article provided to the Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or any other source, the Contractor shall report, in writing, to the Contracting Officer or, in the case of the Department of Defense, to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.
7. Amend section 52.212-5 by—
b. Redesignating paragraphs (a)(2) through (4) as paragraphs (a)(3) through (5), respectively, and adding a new paragraph (a)(2);
Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Items (Jul 2018)
____ (2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).
Alternate II (Jul 2018). * * *
(C) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Start Printed Page 28145Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).
8. Amend section 52.213-4 by—
Terms and Conditions—Simplified Acquisitions (Other than Commercial Items) (Jul 2018)
9. Amend section 52.244-6 by—
[FR Doc. 2018-12847 Filed 6-14-18; 8:45 am]
28141-28145 (5 pages)
FAC 2005-99, FAR Case 2018-010, Item I, Docket 2018-0010, Sequence 1
9000-AN64
1.106,4.2001,4.2002,4.2003,4.2004,13.201,39.101,52.204-23,52.212-5,52.213-4,52.244-6
2018-12847.pdf
48 CFR 4.2001
48 CFR 4.2002
48 CFR 4.2003
48 CFR 4.2004