# Washington Found 700 Affiliates of Banned Tech Suppliers. Its Buyers Still Lack a Shared Warning System.

Published: 2026-11-01

For wider context, Factrail tracks the relevant decision makers and the public consequences through [donald trump](https://factrail.ai/people/donald-trump), [nato deterrence capacity](https://factrail.ai/drivers/nato-deterrence-capacity), and [fiscal policy sustainability](https://factrail.ai/drivers/fiscal-policy-sustainability). These references provide context rather than proof of a specific legal or financial claim.

# Washington Found 700 Affiliates of Banned Tech Suppliers. Its Buyers Still Lack a Shared Warning System.

Factrail investigative analysis | United States | 1 November 2026 | Documentary trigger: GAO-26-108630, 22 September 2026

The finding. Washington has spent seven years barring certain federal purchases connected to five Chinese telecommunications and surveillance companies. The General Services Administration told federal auditors it had identified about 700 subsidiaries and affiliates of those companies by May 2026. Yet the Government Accountability Office found that GSA and the Pentagon had not systematically shared such intelligence across the government. At the same time, [President Donald Trump](/people/mig-donald-trump)'s procurement-rule overhaul was changing how contractors communicate compliance. This is a failure of information distribution and verifiability, not proof that 700 prohibited suppliers won contracts or that a security breach occurred. The same audit records real enforcement: catalog exclusions, contract modifications and a sharp decline in direct federal obligations to the five named companies. The question for Congress and agency leaders is whether those successes can survive a less visible certification system.

## The document that changes the question

The central evidence is the [Government Accountability Office's September 22, 2026 telecommunications report](https://files.gao.gov/reports/GAO-26-108630/index.html). Its auditors reviewed federal procurement and System for Award Management records, interviewed GSA and Defense Department officials, and examined the implementation of Section 889 of the 2019 National Defense Authorization Act. They did not audit every contractor's actual hardware. They did not publish the 700-entity list, establish the identity of each subsidiary, or trace every sale through the federal supply chain. The distinction matters because a hidden affiliate is a screening risk; it is not automatically evidence of an illegal award.

The investigation's added value is to place four separate records on the same decision map: the 2018 congressional prohibition, the contract clauses that translate it into purchasing decisions, the 2025 presidential directive to rewrite federal procurement rules, and the 2026 audit showing what agencies know but have not widely shared. Each record describes a different exercise of power. None should be substituted for the others.

A list can help a purchasing officer ask the right question, but it cannot establish that a company is legally disqualified in every circumstance. Corporate relationships change, equipment categories are legally defined, and exceptions or waivers can apply. Conversely, a contractor's statement that it has not found covered equipment is not a comprehensive technical audit. The federal system must manage both false positives and missed connections.

## The documentary timeline: law, implementation, reform, audit

August 13, 2018. Congress enacted [Public Law 115-232](https://www.govinfo.gov/content/pkg/PLAW-115publ232/pdf/PLAW-115publ232.pdf). Section 889 named Huawei Technologies, ZTE, Hytera Communications, Hangzhou Hikvision Digital Technology and Dahua Technology, with covered subsidiaries and affiliates, as the subjects of restrictions on specified telecommunications or surveillance equipment and services. Congress established the underlying prohibition; a later administration cannot simply erase that statute through procurement guidance.

August 13, 2019. The prohibition on federal agencies acquiring covered equipment or services as a substantial or essential system component, or as critical technology, took effect. The [government's Section 889 policy index](https://www.acquisition.gov/Section-889-Policies) documents the implementation sequence. It is narrower than a blanket ban on every product made in China and broader than a rule applying only to classified military contracts.

August 13, 2020. A second restriction took effect: agencies generally could not enter into or renew contracts with entities using the covered equipment in the legally specified way, even if that use was unrelated to the federal work. The [FAR contract clause](https://www.acquisition.gov/far/52.204-25) contains important exceptions and waiver provisions. The burden therefore extends beyond the seller of a camera or router to the business operations of potential contractors.

2020–2024. Industry groups raised questions about what counts as use, how to discover affiliates and how much diligence is reasonable. [Nextgov/FCW's contemporary reporting](https://www.nextgov.com/digital-government/2020/09/gsa-provides-some-clarity-section-889-implementation/168385/) documented those implementation uncertainties in September 2020. GSA subsequently built automated vendor and catalog screening. Defense officials developed a way for acquisition staff to retrieve supplier representations.

April 15, 2025. Trump signed [Executive Order 14275, Restoring Common Sense to Federal Procurement](https://www.govinfo.gov/app/details/DCPD-202500485), instructing officials to simplify acquisition rules. The order is a policy instruction, not a repeal of Section 889. The regulatory reform that followed placed the restrictions into a reorganized security-and-supply-chain framework and changed the treatment of some representations.

August 2025–July 2026. The Federal Acquisition Regulatory Council issued model deviation language; GSA and DOD implemented agency deviations. GAO counted 29 agencies with relevant deviations by July 2026. A proposed rule published in June 2026 was still part of a regulatory process at the audit's cutoff. The GAO report says the legacy interim rules had not yet been finalized as of July; it does not establish the final legal position on every future solicitation.

September 22, 2026. GAO publicly released the audit. It found that GSA and DOD had taken meaningful compliance actions but had not broadly distributed affiliate information or operational lessons to other agencies. Both agencies concurred with recommendations to improve sharing. Agreement to a recommendation is not evidence that the corrective process has already been implemented.

## The power map: who can change what

Congress wrote Section 889 and retains the power to amend it, require reporting and oversee appropriations. The President can direct executive acquisition reform within statutory limits. The FAR Council and acquisition-policy officials draft the implementing framework, while agency heads issue instructions and deviations to their purchasing staffs. Individual contracting officers decide awards and contract remedies subject to the applicable clauses, waivers and procurement law.

GSA's administrator, Edward C. Forst, leads an agency that manages government-wide buying vehicles and shared acquisition systems. [GSA records his December 2025 appointment](https://www.gsa.gov/about-gsa/newsroom/news-releases/edward-c-forst-sworn-in-as-gsa-administrator-12242025). The Defense Secretary, [Pete Hegseth](/people/pete-hegseth), leads the other major institution in the audit; [the Defense Department identifies him in that role](https://www.defense.gov/About/Secretary-of-Defense/). Their offices have executive responsibility for responding to the GAO recommendations. The report does not show that either official personally decided to withhold a particular affiliate name or approve a particular prohibited product.

DHS's Cybersecurity and Infrastructure Security Agency has existing information-sharing mechanisms that GAO says could help distribute relevant intelligence. It is not, by virtue of that suggestion, the statutory author of Section 889 or the final judge of every vendor's eligibility. GSA and DOD told auditors that the law did not specifically require the broad sharing they had not undertaken. That is an explanation of the existing institutional arrangement, not proof that sharing is unnecessary.

The practical veto is dispersed. A purchasing officer can refuse an award or seek clarification; a contractor can remediate equipment or decline a modification; a waiver authority can permit specified transactions; a court may review a properly presented procurement dispute; and Congress can change the underlying mandate. No single politician personally certifies the millions of products accessible through government buying systems.

## The 700-company list: valuable intelligence, not a conviction register

GSA officials told GAO that by May 2026 the agency had developed information on roughly 700 subsidiaries and affiliates using commercial supply-chain tools, algorithms, origin tracing and news alerts. GSA said it had terminated contracts with entities it determined were subsidiaries of a named company in at least two instances. DOD used similar techniques but did not keep a centralized list, arguing that fast-changing corporate structures could make one inaccurate.

That is a serious counterargument. An obsolete blacklist could unfairly exclude a company after a divestment or confuse a distributor with a manufacturer. Yet the alternative of each agency rediscovering corporate relationships can also produce inconsistent enforcement. The audit's remedy is periodic sharing of evidence and methods, not a static public list treated as infallible.

The size of the problem should not be inflated. About 700 is GSA's internal identification count, not 700 proven federal contractors, not 700 completed illegal transactions and not 700 sanctioned firms under every federal law. A separate [2026 Defense Compliance Report examination](https://thedefensecompliancereport.com/research/ndaa-section-889-banned-list/) counted names in FCC disclosures, but those regulatory lists have different purposes and coverage. They cannot be merged into a single verified master list without entity-level reconciliation.

GAO also reported that commercial supply-chain tools have limits: earlier Air Force testing of several tools found only 60–70 percent accuracy. This is a warning against treating a machine-generated match as a legal conclusion. A responsible agency needs corroboration, an auditable explanation and a route for a vendor to contest a mistake.

## Three impressive numbers—and three misleading conclusions

GSA said automated systems removed more than 5,700 noncompliant catalog items in fiscal years 2024 and 2025. It separately said systems identified about 137,000 products before upload from October 2025 through May 2026 that were not compliant with procurement prohibitions including Section 889. The latter figure covers more than this one statute. Neither figure establishes the number of unlawful purchases, because screening can stop a product before it is sold.

GSA also reported ending 131 contracts by May 2026 because companies did not accept modifications adding the Section 889 clause. A refusal to sign an amended clause is not, by itself, proof that a company secretly used a banned device. The contract-level financial value, named counterparties and final outcomes were not supplied as a verified public accounting record in the audit. Calling the 131 cases security breaches would overstate the evidence.

The GAO analysis of March 2026 System for Award Management records found that almost 90 percent of companies with fiscal 2025 federal contract activity represented that they did not use covered equipment. These firms received more than 98 percent of federal contract obligations. About 1,800 companies, roughly 2 percent of the studied population, represented using covered equipment. That response is not necessarily a finding of illegal contracting: exceptions, waivers, the exact covered use and transaction timing matter. Other companies lacked usable representation data.

Crucially, GAO said contracting officers generally do not routinely validate the accuracy of these statements. Under the legacy FAR, a reasonable inquiry expressly need not include an internal or third-party audit. Thus the 90 percent statistic measures declarations, not the independently tested purity of every supply chain. It would be equally misleading to infer that the remaining firms were all violating the law.

## The reform paradox: less paperwork, potentially less searchable evidence

Trump's April 2025 procurement directive argued that complicated rules make federal contracting expensive and difficult. That concern has a legitimate basis: contractors face recurring compliance tasks, and smaller companies may be deterred from bidding. The [FAR representation provision](https://www.acquisition.gov/far/52.204-24) illustrates the legal and documentary complexity of disclosing covered equipment.

The 2025 model deviations created a different potential trade-off. GAO reported that the new Section 889 model can treat submission of an offer as a representation of compliance, rather than always requiring the older annual check-box representation in SAM. As of the audit, GSA had not finalized how SAM information would be collected under the overhaul; DOD's deviation continued annual representations. Therefore it would be wrong to say that all federal declarations were abolished or that all 2026 contracts followed one rule.

But the question is real: if a shared system contains fewer explicit, queryable compliance responses, what replaces that screening signal for the government employee making a small purchase? DOD told auditors that about half of its purchase-card micro-purchases involved vendors with SAM compliance representations. Other vendors require more time-consuming checks. An offer-level legal representation may preserve liability while making rapid, centralized screening less straightforward.

The appropriate comparison is not paperwork versus security in the abstract. It is the cost of a particular declaration and the measurable effectiveness of the alternative process. Congress can ask whether reduced filing burdens were offset by timely access to affiliate intelligence, case-by-case vendor checks, corrective actions and actual incident rates. GAO's report does not yet provide that complete cost-benefit evaluation.

## Who receives the financial benefit—and who bears the cost?

The five expressly named companies—Huawei, ZTE, Hytera, Hikvision and Dahua—face constrained access to the specified federal procurement market, along with covered affiliates and subsidiaries. Their commercial rivals selling compliant alternatives may benefit from demand shifted by the restrictions. Established contractors with dedicated compliance teams may be better positioned to absorb screening costs than a small bidder entering federal procurement for the first time. Those are identifiable economic mechanisms, not evidence of a quantified windfall to any particular manufacturer.

GSA itself buys commercial supply-chain intelligence. The GAO report describes blanket purchase agreements that make vendor-vetting and supply-network tools available and says several federal organizations have ordered through those vehicles. That creates a legitimate paid market for compliance services. The audit, however, does not supply a complete vendor-by-vendor payment accounting record or establish that any supplier of screening tools influenced the statute or the 2025 reform. We therefore do not assign a dollar benefit or political connection to an unnamed contractor.

Taxpayers and agencies bear the cost of due diligence, remediation, replacement equipment and delayed procurement where alternatives are difficult. The benefit they seek is reduced exposure to equipment deemed a national-security risk. These costs and avoided risks are not directly comparable without contract prices, technical tests and incident data. A larger number of rejected catalog entries does not prove greater national-security savings.

The largest material beneficiaries of consistent enforcement may be people who depend on reliable public infrastructure and government systems. But there is no defensible number here for prevented cyberattacks, saved household income or changed national welfare indicators. Those effects should be measured, not invented for an accountability score.

## The overseas waiver that complicates a simple crackdown narrative

The Pentagon told GAO that foreign operations can depend on host-country telecommunications infrastructure containing covered technology. In some settings a compliant replacement may not be available for a fuel purchase or other operational necessity. DOD described three waiver circumstances, two classified.

GAO found that product and service codes covered by one broad waiver accounted for approximately $150 billion, or 31 percent, of DOD's fiscal 2025 contract obligations. That is the scope of contract categories under a waiver—not $150 billion of banned equipment purchases. Less than 1 percent of that obligation total went to nearly 600 companies representing use of covered equipment, and GAO found no obligations in that analysis to the five expressly identified companies. DOD recognized that it had not established the precise number of transactions that actually needed the waiver.

This is the strongest quantitative illustration of the oversight dilemma. A wide permission can prevent mission disruption, but the headline value of contracts inside its categories tells little about the actual exception rate. Congress could request a transaction-level account, with classified details protected, showing when a waiver was necessary and what alternatives were considered. Without that evidence, neither a claim of mass evasion nor a claim of perfect calibration is established.

## The strongest counter-case: enforcement has demonstrably worked

The record does not support portraying the government as having done nothing. GAO found that federal obligations on contracts awarded directly to the five named companies fell after the prohibition. It identified no such obligations in fiscal years 2022, 2023 and 2025. The audit also records automated catalog screening, agency guidance, remediation, vendor-representation tools and GSA's use of customs and supply-chain information.

The finding is bounded. The obligations analysis excludes deobligations and does not prove whether every earlier transaction involved equipment covered by Section 889. GAO notes a DOD obligation of less than $2,000 in fiscal 2024 to a Hytera-owned entity for electrical components not generally treated as telecommunications or surveillance equipment. It is not evidence of a major clandestine supply route.

Both GSA and DOD agreed with GAO's recommendations. GSA said it was developing a plan; DOD said it would assess criteria for identifying related companies and coordinate on sharing through appropriate mechanisms. That response deserves weight. The audit describes an actionable governance gap, not defiance of a court order, an established procurement conspiracy or an admission that prohibited products were knowingly bought.

Industry objections also have substance. [Nextgov/FCW documented defense-industry concerns](https://www.nextgov.com/digital-government/2021/02/industry-group-gives-defense-contractors-c-health-grade-annual-report/171835/) about unclear definitions, unidentified affiliates and the cost of replacing equipment. The government should not treat every request for clarification as a lobbying attempt to evade security law. Equally, business inconvenience does not by itself invalidate a restriction enacted by Congress.

## What the audit cannot prove about politicians or corporate money

The available records identify Trump as the author of the 2025 procurement directive, Congress as author of the statutory restrictions, Forst and Hegseth as leaders of agencies receiving recommendations, and procurement officials as implementers. They do not establish that any of those individuals took a payment from a covered company, directed a contract to an associate, or intentionally suppressed a warning. No campaign donation, lobbying expenditure or beneficial-ownership link has been verified as causally connected to this particular information-sharing failure.

The named companies are the statutory subjects of restrictions, not automatically defendants in a newly discovered criminal case. A corporate affiliate appearing in a screening tool is not a judicial finding of wrongdoing. The audit also did not establish an espionage event caused by a failed procurement check. These limits are essential to evaluating responsibility without inventing motives or legal outcomes.

A further distinction is institutional time. The law predates the current administration, while the September 2026 report evaluates implementation across several administrations. Current officeholders are responsible for the corrective actions within their authority; that does not make them the personal authors of every older procurement decision.

## What it moves—and the test Congress can actually apply

The most immediate indicators are administrative and observable: how often GSA and DOD refresh related-company intelligence; how many federal agencies receive and use it; how quickly an agency can verify a supplier; what proportion of contractor representations can be corroborated; how many adverse findings are corrected; and whether the new FAR process preserves usable data for purchase-card holders. Those are proposed measures, not already published Factrail indicator scores.

A second layer is financial: the number and value of awards affected by verified noncompliance, the cost of remediation, and the proportion of overseas waivers actually necessary. Reporting should distinguish a blocked catalog listing, a terminated contract, a lawful waiver, an obligation, a payment and an established violation. Combining them into one dramatic total would conceal rather than reveal public exposure.

The 2027 deadlines raise the stakes. GAO identified forthcoming restrictions involving certain magnets and metals in January 2027 and certain Chinese semiconductors in December 2027. Those supply chains may extend several tiers beyond a prime contractor. GAO described a Pentagon F-35 mapping effort that had identified first- and second-tier suppliers for 30,000 of 40,000 parts by April 2025 but fewer than 10 percent of lower-tier suppliers. The specific program figures are not a measure of Section 889 violations; they show why future compliance cannot rely solely on a familiar parent-company name.

The decision that would change this assessment is verifiable: an agency-to-agency sharing protocol with dated updates, documented recipient coverage, a method for challenging erroneous matches, and measured outcomes under the new representations regime. An audited transaction accounting record showing actual prohibited purchases would strengthen the case that current controls failed; evidence that all relevant buyers received current intelligence and detected prohibited awards would weaken it. Until then, the defensible verdict is narrower but consequential: Washington built useful screening understanding, then failed to ensure that understanding consistently reached the officials responsible for enforcing the same law.

## Evidence and source notes

The principal record is [GAO-26-108630, September 22, 2026](https://files.gao.gov/reports/GAO-26-108630/index.html), including its agency responses and methodology. The legal basis is [Public Law 115-232](https://www.govinfo.gov/content/pkg/PLAW-115publ232/pdf/PLAW-115publ232.pdf), the [government's Section 889 implementation index](https://www.acquisition.gov/Section-889-Policies), and the [FAR clause](https://www.acquisition.gov/far/52.204-25). The reform instrument is [Executive Order 14275](https://www.govinfo.gov/app/details/DCPD-202500485). Independent reporting from [Nextgov/FCW in 2020](https://www.nextgov.com/digital-government/2020/09/gsa-provides-some-clarity-section-889-implementation/168385/) and [2021](https://www.nextgov.com/digital-government/2021/02/industry-group-gives-defense-contractors-c-health-grade-annual-report/171835/) records the contractor-side disputes. No rights-of-reply outreach, contract-by-contract financial audit, or direct Factrail internal-link verification is claimed.

## Methodology

https://factrail.ai/methodology

Canonical: https://factrail.ai/articles/us-section-889-affiliate-list-procurement-oversight-2026