TikTok off the Clock: Navigating the TikTok Ban on Devices for Government Contractors
Transcript
Craig
Welcome back, everyone, to the Government Contracts podcast series. I’m your host, Craig Smith. Today I’m joined by my partner, Tracye Howard, and my fellow colleague, Jennifer Retener. And what are we here to talk about? Well, for the past several years, just like high school teachers nationwide, Congress and the executive branch under both the Trump and Biden administrations have been expressing national security concerns about TikTok and parent company, ByteDance. Those concerns led to the No TikTok on Government Devices Act, which doesn’t have a really good acronym and that’s a shame, but it was enacted last year. Then implementing guidance for agencies and government personnel from OMB earlier this year in February, and then most recently a June 2023 interim rule from the FAR Council to implement that statute ban on TikTok use on some government contractor devices. We dropped an alert on that a few months ago and it’s time to check in. So Tracye and Jennifer are here with me to discuss what the FAR rule says and what it means for government contractors. So Tracye, let’s start with you. What are these concerns that Congress is trying to address with the legislation in the first place?
Tracye
Sure. So we have to connect a few dots to get there. The first is ByteDance, the parent company that produces TikTok, is a Chinese company. It’s headquartered in Beijing. Then we need to look at what is it that TikTok has access to on a user’s phone? When a person downloads the app, it grants permission to access the device’s storage and access the WiFi connection, and that means the app can collect data without the user’s knowledge, including things like the device brand and model, the mobile carrier, the operating system, the phone number, the user’s email address, browsing history, contact lists, a long list of things. Then we have to look at the Chinese government has what’s called a National Intelligence Law, which allows it to compel companies that are within the Chinese government’s jurisdiction to provide data to the government whenever it makes those requests. So putting all that together, you can see the concern here from our government is that the Chinese government would get access to this sensitive information on the users of TikTok, which would include government personnel and contractor personnel. The other concern is that the TikTok app could be used to turn on, say, the microphone or the camera on a user’s device without their knowledge and turn the device into some sort of surveillance equipment.
Craig
And, I mean, in some ways, we’ve heard that about various types of home office assistants or other devices, but I guess the concern here is this is not a domestic company that would be pulling the strings.
Tracye
Exactly. And I want to be clear, there’s no evidence that the Chinese government has done this, in the past, or is currently requiring TikTok to provide this data on its users, but the possibility exists, and so that’s the basis for the concerns that have been expressed across the last two administrations and members of Congress.
Craig
I was thinking when I was growing up, it was “Tick Tock... You Don't Stop,” but this interim rule takes a different approach. And Jennifer, maybe for those who hadn’t had a chance to read our alert yet, what are the high points that someone needs to know about?
Jennifer
Sure. So, the rule has two aspects. One, the contractor is prohibited from having or using a covered application on any information technology owned or managed by the government, or two, on any information technology used or provided by the contractor under this contract. And here a covered application means, you know, the TikTok application or any other application made by ByteDance. So, this rule prohibits contractors from downloading or accessing TikTok or other ByteDance applications on a device that that person uses to perform a government contract. The clause expressly states that the prohibition applies to employees personal bring your own devices that they use to perform at work. So, as you know, most companies often allow their employees to use their personal cell phones or tablets to perform their work, and with these personal devices, they can access the company’s network for email, timekeeping, and other administrative functions. Some employees even have their own laptops, personal laptops at work to perform government contract work.
Craig
It still blows my mind. I just have to say.
Jennifer
Well, it saves on costs.
Craig
Yeah, I guess so.
Jennifer
So, the prohibition applies to all contracts, and this includes contracts that are at or below the simplified acquisition threshold and contracts for commercial products. This includes procurements for commercially available off-the-shelf, or COTS items, and commercial services.
Craig
So, it gets pretty granular and pretty far field when it comes to how far the government’s purchasing things. I mean, this is not a cost accounting standard thing or something where it’s very focused on a particular swath of contractor base.
Jennifer
Right. The prohibition applies pretty broadly to all types of contracts. In addition to the ones I mentioned, it also applies to purchases that are at or below the micro-purchase threshold, which is currently at $10,000.
Craig
I think that’s going to catch some people there. And we said it’s an interim rule, so taking effect?
Jennifer
Yes, the rule was effective immediately when it was published on June 2, 2023. However, as with everything in government contracting, though, this rule is implemented when the government incorporates the FAR clause into specific contracts. So contracting officers have begun including the clause, which is 52.204-27, in solicitations, new contracts, contract modifications, and extensions immediately after the rule was issued. So contractors should start seeing the clause in their contracts soon if they haven’t already.
Craig
Those 52.204 in the mid twenties, that’s just the sweet spot of Congress’s gifts to contractors over the years. So, another thing to figure out. My understanding is that people who are over 18 use TikTok, I’ve heard that, and so contractors will have people in the workforce who are using the app, and Tracye, what, if I’m a contractor, what do I need to be thinking about with this rule?
Tracye
Absolutely. So, the rule in the preamble says that the FAR council doesn’t really think this is going to be too onerous for contractors because it expects that they already have technologies in place that allow them to block what they call nefarious websites. And for some, for a lot of companies, I think that that’s true. Most larger companies have IT systems in place that allow them to block various websites and downloads for a number of reasons. It may be for security, it may be just for time management because they don’t want their employees spending time on certain websites, or for a variety of other reasons. And so for companies that have that technology already, they’re just going to add TikTok to the list of banned websites and apps, and that’ll be pretty simple. The issue comes in with, obviously not all contractors have those systems in place, and so they’re going to need to come up with some separate policies. And the other thing is, those systems may not and probably don’t cover the bring your own devices that employees are using also to do their work, and so contractors are trying to figure out, what do the policies look like? And they’re going to have to issue some written policies and procedures for those devices.
Craig
Do you think we might see some more people having to do the dual cell phone look?
Tracye
You know, that’s obviously one option, and, I want to stress that here, the rule is not that contractor employees can never use TikTok in any way, shape, or form. It’s specific to devices, and certainly employees are free to use TikTok on any other devices except those that they’re using to perform their government contracts. So I understand that some contractors have expressed concerns about employee retention, particularly for younger employees, but I think it’s important to have some perspective here about what exactly is and is not prohibited under the rule.
Craig
But I think that the point you just made, Tracye, one that’s also important to not lose sight of, is I joke about, oh, the kids these days because I’m too old to use these things, but there is a large portion of the workforce that uses TikTok regularly for a lot of things, and it’s important. And so being thoughtful about that share of the workforce, which, you know, is the future of your workforce, it’s not an easy balance. And my sense from hearing you talk about the work you’ve done with contractors is, it is very possible to underestimate the reaction that employees may have to restrictions on this.
Tracye
Absolutely. It’s something that companies need to, you know, be cognizant of and maybe incorporate into their messaging when they’re rolling out these new policies and procedures.
Craig
But that’s just at the federal level. So the states have to get in on this too. And what are they up to?
Tracye
So a lot of states are addressing this as well. We’re up to more than 30 states have implemented TikTok bans in some form or another, either through statute or regulation. The extent of those varies, and my sense is that most of them are specific to government employees and government owned or issued devices. But there may be some that also affect contractors, and for those contractors who are in the federal space and also do state government work, I would encourage them to understand what those state government laws are and how they may dovetail with the federal statute or may, in some cases, be broader, and that may inform how they want to craft their policies for federal government contracts, and it may lean toward maybe a broader application than what’s strictly required in the FAR Clause.
Craig
I mentioned a few moments ago that difficult spot in the 52.204 20’s clauses and I think of the section 889 of the NDAA from a few years ago with the Huawei restrictions, which there’s an interim rule that’s been out for a number of years, unclear when we’re going to see a final rule, but the idea is there will someday be a final rule. And Jennifer, I’m imagining, there will be a someday there’s a final rule for this one, too.
Jennifer
Right. We’re likely thinking, yes, there will be a final rule at some point. So public comments on the interim rule were submitted through August 1. The FAR Council will likely review those comments and then make revisions for the final rule that could be issued in the future. The statute however is fairly specific, and the final rule can’t deviate from that, but the FAR Council might choose to include further explanations or definitions to some of the terms that they used, like what using a device under a particular contract means. And contractors may need to adjust their policies and procedures accordingly to ensure that they’re continuing to comply with the rule.
Craig
And by the time that the drafters have figured it all out, gotten it through OFPP, everyone will have moved on to the new social media thing that doesn’t exist yet. So, something to look forward to when it comes to your compliance. So, Tracye, Jennifer, thank you so much for joining us today. I think this is a great way as we kind of get back into the swing of things with August rolling into September. For contractors that haven’t been as focused on TikTok, this is a good time to do a check in on that and make sure that they’re complying with the interim rule.
Thanks so much for joining.
