Introduction

This report provides background information and issues for Congress concerning the potential risk of foreign, particularly adversarial government, influence on Department of Defense (DOD) contractors.¹ This report also provides an overview of legislative activity over the last ten years on this topic, as well as selected current DOD efforts to mitigate unwanted foreign influence of contractors.

Issues for Congress

Some oversight issues for Congress regarding foreign influence and DOD contracting include whether or not to amend statutory requirements banning or limiting certain companies with ties to adversarial governments from being awarded certain categories of DOD contracts. Congress may consider whether or not to require DOD to take action to further mitigate the potential risk of foreign influence in contracting. Congress may also consider taking no action or scaling back its current foreign influence mitigation efforts.

Background

Foreign direct investment in the United States–that is, the ownership or control, direct or indirect, by a foreign entity of U.S.-based firms–has generally increased over the past ten years.² Some U.S. firms, including some Department of Defense (DOD) contractors, receive foreign investment or have other ties to foreign entities, including foreign firms and foreign governments. Some DOD contractors' foreign connections could include ties such as ownership, investment, supplier or producer relationships, or production overseas. These ties may pose a risk to U.S. national security, especially when those performing work of a sensitive or classified nature have potential ties (such as foreign ownership and control) to adversarial countries.

DOD's Defense Counterintelligence and Security Agency (DCSA) is responsible for mitigating potential risks that may arise from foreign investment and foreign ties to DOD contractors. According to DCSA, Foreign Ownership, Control, or Influence (FOCI) occurs "whenever a foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable, to direct or decide matters affecting the management or operations of that company in a manner which may result in unauthorized access to classified information or may adversely affect the performance of classified contracts."³

Statute and Regulation

DOD contracting-related statutes are covered in Titles 10 and 41 of the U.S. Code. Title 41 addresses federal procurement in general; its requirements apply to DOD unless otherwise specified in Title 10. Title 10 addresses DOD procurement specifically. The procurement provisions in Titles 41 and 10 are implemented by the Federal Acquisition Regulation (FAR) and the DOD-specific FAR supplement, the Defense Federal Acquisition Regulation Supplement (DFARS).⁴

Over the last 10 years, Congress and DOD have taken several approaches to change laws and regulations to further mitigate FOCI concerns with DOD contractors. One method Congress and DOD have used to mitigate FOCI risks is to require in statute that only a U.S.-owned company may provide certain types of goods or services and that DOD may not purchase such goods from companies with ties to certain countries. The way that DOD and Congress have defined such restrictions and categories has varied over time. Legislation over the last 10 years has added new types of goods or services to these lists and some observers have proposed that this list be further expanded.

Title 10, U.S. Code

Various sections of Title 10 include prohibitions on DOD's procurement of certain categories of goods and services from companies that have ties to certain countries or organizations that could pose a risk to U.S. national security. Additionally, several sections in Title 10 include specific procedures that DOD must follow to reduce the risk of foreign influence. Many of these provisions stem from legislation enacted over the last ten years, particularly sections that specifically call out the government and military of the People's Republic of China (PRC or China). The following section provides an overview of selected laws and legislation aimed at mitigating the potential risk of foreign influence in DOD contracting.

Defense Federal Acquisition Regulation Supplement (DFARS)

Many of the Title 10 provisions that stem from legislative action are ultimately implemented by DOD in the Defense Federal Acquisition Regulation Supplement (DFARS). The DFARS, the DOD-specific supplement to the FAR, does not contain blanket restrictions on foreign entities' investment or other forms of involvement with DOD contractors. However, the DFARS does include restrictions on the acquisition of some items from certain companies. For example, one portion of the DFARS outlines a prohibition on some items from companies that have known ties to the PRC military.⁵

Selected Laws Related to Foreign Influence and DOD Contractors

The following sections present selected laws related to the potential risk of foreign influence in DOD contracting. Several provisions impose federal procurement restrictions on selected categories of technologies produced by certain companies and produced by other companies owned or controlled by, or otherwise connected to, the governments of adversarial countries. Additionally, some provisions address certain goods and services produced by certain PRC government-affiliated entities, such as the Huawei Technologies Company (Huawei).⁶

Many of these provisions were enacted at the same time that the U.S. government began to characterize its sometimes-tense relations with countries such as the PRC and the Russian Federation (Russia) as a great power competition (GPC).⁷ During this time, both Congress and the executive branch identified foreign influence, supply chain risks, and risks involving DOD contractors as part of GPC.

Fiscal Year 2018 National Defense Authorization Act (NDAA), P.L. 115-91

Section 1656 of the FY2018 National Defense Authorization Act (NDAA) required that the Secretary of Defense submit to the congressional defense committees an assessment of the extent to which DOD relied on certain categories of telecommunications equipment that were produced or provided by certain foreign-affiliated entities (including Huawei) to fulfill nuclear deterrence and ballistic missile defense missions.⁸ This provision allowed DOD to submit waivers for this requirement on a case-by-case basis, but required that these waivers be submitted by the Secretary of Defense and not be delegated to lower levels of authority, which suggests a high level of importance, because many categories of acquisition requirements may often be waived at lower component levels.

John S. McCain National Defense Authorization Act for Fiscal Year 2019, P.L. 115-232

Section 889 of the FY2019 NDAA imposed federal procurement restrictions on certain telecommunications and video surveillance goods and services from several companies affiliated with the PRC, including the Huawei Technologies Company and the ZTE Corporation.⁹ This prohibition applies to DOD, and includes a prohibition on loans and grants, in addition to contracting. The Federal Acquisition Regulatory Council issued several interim rules implementing this statute beginning in August 2019, including detailed requirements for DOD, as well as other covered agencies.¹⁰ This restriction was implemented in the DFARS in Section 252.204-7018 and includes waiver requirements and procedures should a DOD entity need to work with a contractor using covered equipment.¹¹

Defense industry groups protested the timeline, intensity, and complexity of this requirement in 2020, the originally planned time of its implementation. For example, a representative of the Professional Services Council, an advocacy group for federal service contractors, said that "the potential impact under the statute could affect nearly every contractor and subcontractor across the entire federal government," and that there were "consequences that reach beyond prime contractors."¹² Other commentators raised concerns about the lack of clarity concerning applicability of the new requirements for subcontractors.¹³

In August 2020, the Director of National Intelligence (DNI) granted DOD a temporary waiver to address some of these concerns and "to provide time to review the full details of the rule implementation using additional information from DOD," according to a statement from DOD.¹⁴

William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, P.L. 116-283

Section 819 of the FY2021 NDAA amended a note in Title 10 of the U.S. Code requiring DOD to "require reports and conduct examinations" of covered contractors "to assess compliance" related to FOCI mitigation efforts.¹⁵ The provision also required that DOD develop "procedures for appropriately responding to changes in covered contractor of subcontractor beneficial ownership status based on changes in disclosures of their beneficial ownership and whether they are under FOCI…"¹⁶ This requirement was part of a broader initiative that began in the FY2020 NDAA to modernize acquisition processes and ensure integrity of the defense industrial base.¹⁷

According to DOD, its Acquisition Technology and Information Team was tasked in 2021 with drafting the proposed DFARS rule partially implementing this provision; its report due date was extended to June 2024.¹⁸

Section 1260H of the FY2021 NDAA required that DOD "identify each entity the Secretary [of Defense] determines based on the most recent information available, is operating directly or indirectly in the United States or any of its territories and possessions, that is a Chinese military company."¹⁹ This provision included the traditional definition of PRC military companies, and also what it calls "military-civil fusion contributors," which includes a more expansive definition of ties to the PRC military and government beyond companies with explicit ties to the Chinese military.²⁰ Beyond ties to the People's Liberation Army or the Central Military Commission of the Communist Party of China, a "military-civil fusion contributor" may have ties to organizations such as the PRC Ministry of Industry and Information Technology or "entities that advertise on national, provincial, and nongovernmental military equipment procurement platforms in the People's Republic of China."²¹ DOD is to submit this information annually to the Armed Services Committees and publish an unclassified version of its list in the Federal Register until 2030.²²

The most recent version of the notice of designation of Chinese Military Companies was released in the Federal Register on April 2, 2024, in accordance with this legislation's statutory reporting requirements.²³

Fiscal Year 2022 NDAA, P.L. 117-81

Section 855 of the FY2022 NDAA tasked DOD with requiring that certain contractors and subcontractors disclose if they have employees "who will perform work in the People's Republic of China on a covered contract."²⁴ Per the provision, contract funding is be withheld until this information is provided to DOD, potentially making enforcement of this amendment easier by incentivizing contractors to provide this information expeditiously.²⁵ Additionally, DOD is to provide semi-annual briefings to congressional defense committees summarizing the information it finds from such disclosures.²⁶ While not an explicit restriction of DOD contractors that work in the PRC, this additional information may support security and contracting officers when conducting due diligence.

This Federal Acquisition Regulatory Council implemented this provision when it amended a portion of the DFARS that addressed DOD contract solicitation provisions, which was last updated in March 2024.²⁷

James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, P.L. 117-263

Section 5949 of the FY2023 NDAA imposed restrictions on the procurement of goods or services that include components from semiconductor companies with links to certain countries.²⁸ It also imposed a restriction on the procurement of goods and services for "a critical system" that "uses" components from these covered semiconductor companies.²⁹ The final version of the legislation changed the word "use[s]" to "include[s]," which some analysts assert represented a less strict, "scaled back" version of the originally proposed legislation.³⁰ This change came after reported pushback from multiple industry and trade groups, including several defense industry groups.³¹

Similar to earlier NDAA provisions, this legislation also allows an executive agency head to waive, for two years, the prohibition if "no compliant product or service is available to be procured as, and when, needed at United States market prices or a price that is not considered prohibitively expensive," and if "such waiver could not reasonably be expected to compromise the critical national security interests of the United States."³²

In the Joint Explanatory Statement, the defense committees noted that

the intent of Congress in advancing this proposal is that, in serving federal supply chains, Federal contract recipients and their suppliers (including domestic and foreign subsidiaries, affiliates, distributors, and intermediaries) should not utilize companies connected to foreign countries of concern that threaten national security, such as Semiconductor Manufacturing International Corporation, Yangtze Memory Technologies Corp, and ChangXin Memory Technologies, or any other company identified under this section (including any affiliate, subsidiary, successor, distributor, or intermediary thereof). Furthermore, we believe that for the purposes of waivers that may be issued under this section, critical national security interests of the United States may include protecting the Nation's economic security and its technological competitiveness relative to strategic competitors…the intent of this provision is to include both contractors and suppliers, to the extent possible under the Federal Acquisition Regulation.³³

This provision received mixed reactions from outside groups. Some pro-commerce advocacy groups praised the provision, saying that it would "[protect] against Chinese cyber threats and any dependence on China for our critical infrastructure and defense capabilities."³⁴ Other commentators have noted that the prohibitions may be onerous for potential DOD contractors, saying that contractors may need "dedicated supply chain security personnel who are going to be responsible for all of the regulations that are coming out in this area."³⁵

Current Efforts to Mitigate Foreign Influence of DOD Contractors

Beyond the statutory and regulatory measures detailed above, DOD maintains other programs that aim to mitigate the risks, extent of, and impact of foreign influence in DOD contracting. Some of these programs, such as the National Industrial Security Program (NISP), protect certain categories of contracts, such as classified contracts, while other programs aim to protect certain components of DOD, such as science and technology programs.

In addition to DOD-specific requirements and programs, DOD contractors must also follow U.S. export control regulations and decisions, which apply to all U.S. firms. The U.S. Department of Commerce maintains a control list of dual use technologies, which have both civilian and military uses and are subject to export controls. The Commerce Department also maintains lists of entities that pose proliferation or foreign policy concerns and require additional licensing requirements or restrictions.³⁶

National Industrial Security Program (NISP)

The NISP applies to contractors that have access to classified information and/or perform classified contracts and has specific restrictions for contractors regarding FOCI. The NISP was established in 1993 by Executive Order (E.O.) 12829, "The National Industrial Security Program," with the intent to "safeguard Federal Government classified information that is released to contractors, licensees, and grantees."³⁷ The E.O. states that the NISP "shall serve as a single, integrated, cohesive industrial security program to protect classified information and to preserve our Nation's economic and technological interests."³⁸

NISP regulations outline specific FOCI mitigation procedures for contractors that possess security clearances, including the NISP Operating Manual (NISPOM), located in the Code of Federal Regulations (C.F.R.). The NISPOM requires that cleared contractors report to DOD any FOCI, including foreign classified contracts and "loss, compromise, or suspected compromise of classified information."³⁹

The NISPOM notes that the requirements for a "classified contract" (including FOCI-related procedures) are also "applicable to all phases of precontract, license or grant activity, including solicitations (bids, quotations, and proposals), precontract negotiations, post-contract activity, or other government contracting activity (GCA) programs or projects which require access to classified information by a contractor."⁴⁰ Additionally, DCSA has specific requirements for contractor and subcontractor facility clearances to ensure the protection of classified information.⁴¹

According to the NISPOM, when the cognizant security agency has "determined that an entity is under FOCI, the primary consideration will be the protection of classified information" and the government will "take whatever action is necessary to protect classified information."⁴²

Technology Protection Programs

Data-sharing and intellectual property-related requirements and provisions for DOD contracts are often contract-specific. A 2021 update to Department of Defense Instruction (DODI) 5000.83 Technology and Program Protection to Maintain Technological Advantage establishes policy for science and technology (S&T) managers to protect DOD innovation.⁴³ The DODI states DOD contractors and contractor facilities "are at risk of attacks by state and non-state threat actors."⁴⁴ The DODI also tasks S&T managers and "lead systems engineers" with developing "risk informed protection planning and management of their technology… to mitigate adversary impacts."⁴⁵

Agency-Specific DOD Foreign Influence Mitigation Programs

Some DOD offices or agencies maintain their own programs or efforts to mitigate the potential impact of foreign influence for contractors or other nongovernmental partners. For example, the Defense Advanced Research Projects Agency (DARPA) has its own Countering Foreign Influence Program (CFIP), which addresses academic partners for DARPA-funded research.⁴⁶ Congress might consider whether to require DOD to assess the CFIP and whether it could be integrated into other programs or organizations.

Similarly, in 2023, DOD announced efforts to protect DOD-funded research at educational institutes, including issuing a "Policy for Risk-Based Security Reviews of Fundamental Research."⁴⁷ Congress may also consider studying or requiring a study of the potential efficacy of a similar initiative aimed at uncleared contractors that would specifically focus on foreign influence using a risk-based framework.

Mitigating Foreign Influence for Small Businesses

Understanding the potential risk of foreign influence on small businesses is a particular concern for DOD, as smaller companies may lack the resources for protection from foreign influence efforts.⁴⁸ In 2023, DOD released a Small Business Strategy that aimed to bring small businesses into the defense industrial base, including nontraditional vendors.⁴⁹ According to DOD officials, mitigating the potential negative effects of foreign influence is "arguably [one of] the most pressing issues faced by small businesses," as adversaries may find small firms to be an easier target for espionage, cyber threats, or intellectual property (IP) theft.⁵⁰

Small businesses that provide unique or innovative technologies are at particular risk of foreign influence efforts, as are companies that struggle to obtain financing. In 2020, DOD established the Trusted Capital Digital Marketplace program, which connects vetted trusted capital providers investors with qualifying domestic companies critical to the DIB.⁵¹ This program was intended to allow DOD contractors to have access to funding that is safe from FOCI risk and "limit foreign access to critical technology."⁵² Then-Undersecretary of Defense for Acquisition and Sustainment Ellen Lord cited "adversarial capital," or investment funding from countries of concern, "whether that be in terms of intellectual property or whether that be technology development or manufacturing," as a driving factor for creating the program.⁵³

Issues for Congress

Congress may consider taking no action, taking legislative action, or directing DOD to take action to further mitigate the potential risk of foreign influence with its contractors. Actions available to Congress include the following:

• Title 10, U.S.C. and Foreign Ownership Limitations. Congress might consider whether or not to amend Title 10 of the U.S. Code to broaden the categories of goods or services subject to oversight or named as covered items. Several portions of Title 10 include prohibitions of DOD contracting with companies affiliated with certain countries for certain goods or services, generally goods or services related to sensitive military capabilities–such as nuclear command, control, and communications, or satellite services. For example, a note in 10 U.S.C. §2302 establishes that DOD may not procure certain categories of goods through a contract or subcontract from any PRC military company, with certain exceptions.
• DOD Definitions of Foreign Influence. Congress might consider whether or not to require DOD to clarify or standardize its guidance language about foreign influence. According to the NISPOM, "factors relating to the entity, relevant foreign interests, and the government of such foreign interests, as appropriate, will be considered in the aggregate to determine whether an applicant entity is under FOCI."⁵⁴ It lists several of these factors, including a record of espionage, and "source, extent, and nature of FOCI," such as "whether foreign interests hold a majority or minority position in the entity."⁵⁵ The current description of the assessment criteria does not elaborate on what factors are considered the most critical or how security officers define and identify these factors.
  
• Centralizing Foreign Influence Mitigation Efforts. Congress might consider whether certain mitigation programs that are currently limited in scope or implemented by a segment of DOD could be implemented across the department. Some agencies within DOD have their own foreign influence mitigation programs. Congress might additionally consider whether to require DOD to implement agency-wide conflict of interest mitigation programs. A 2021 Government Accountability Office (GAO) study found that DOD lacked an agency-wide process for identifying conflicts of interest for grant awards.⁵⁶ The report noted that during its interview process DOD and the Department of Energy told GAO that "they are working on developing agency-wide conflict of interest policies," but reportedly it is not certain if progress on these policies has been made.⁵⁷
• Requiring Leadership Ownership of Foreign Influence Mitigation Efforts. DOD instructions and policies such as its "Technology and Program Protection to Maintain Technological Advantage" delegate responsibility for protecting DOD IP to the S&T mangers and lead systems engineers.⁵⁸ Congress may consider requiring that this responsibility reside at higher levels of DOD leadership to require streamlined reporting and accountability structures.
• Providing Continued or Increased Oversight of Current Efforts. Congress may also consider increasing its oversight of DOD IP protection policies and protocols, or providing DOD program managers with additional resources, which could include additional reporting requirements, supporting a centralized reporting information database, or additional funding to support foreign influence mitigation efforts in the unclassified contract space. Alternatively, Congress may consider maintaining the level of oversight it exercises, or decreasing it, thus allowing DOD to develop its own policies and exercise more autonomy on this matter.