Defense Federal Acquisition Regulation Supplement: Disclosure of Information Regarding Foreign Obligations (DFARS Case 2018-D064)

DEPARTMENT OF DEFENSE <SUBAGY>Defense Acquisition Regulations System</SUBAGY> <CFR>48 CFR Parts 212, 213, 217, 239, and 252</CFR> <DEPDOC>[Docket DARS-2024-0034]</DEPDOC> <RIN>RIN 0750-AK23</RIN> <SUBJECT>Defense Federal Acquisition Regulation Supplement: Disclosure of Information Regarding Foreign Obligations (DFARS Case 2018-D064)</SUBJECT> <HD SOURCE="HED">AGENCY:</HD> Defense Acquisition Regulations System, Department of Defense (DoD). <HD SOURCE="HED">ACTION:</HD> Proposed rule. <SUM> <HD SOURCE="HED">SUMMARY:</HD> DoD is proposing to amend the Defense Federal Acquisition Regulation Supplement (DFARS) to implement a section of the National Defense Authorization Act for Fiscal Year 2019, which prohibits DoD from acquiring products, services, or systems relating to information or operational technology, cybersecurity, industrial control systems, or weapon systems through a contract unless the offeror or contractor provides disclosures related to sharing source code and computer code with foreign governments. </SUM> <EFFDATE> <HD SOURCE="HED">DATES:</HD> Comments on the proposed rule should be submitted in writing to the address shown below on or before January 14, 2025, to be considered in the formation of a final rule. </EFFDATE> <HD SOURCE="HED">ADDRESSES:</HD> Submit comments identified by DFARS Case 2018-D064, using either of the following methods: ○ <E T="03">Federal eRulemaking Portal: https://www.regulations.gov.</E> Search for DFARS Case 2018-D064. Select “Comment” and follow the instructions to submit a comment. Please include “DFARS Case 2018-D064” on any attached documents. ○ <E T="03">Email: osd.dfars@mail.mil.</E> Include DFARS Case 2018-D064 in the subject line of the message. Comments received generally will be posted without change to <E T="03">https://www.regulations.gov,</E> including any personal information provided. To confirm receipt of your comment(s), please check <E T="03">https://www.regulations.gov,</E> approximately two to three days after submission to verify posting. <FURINF> <HD SOURCE="HED">FOR FURTHER INFORMATION CONTACT:</HD> Ms. Heather Kitchens, telephone 571-296-7152. </FURINF> <SUPLINF> <HD SOURCE="HED">SUPPLEMENTARY INFORMATION:</HD> <HD SOURCE="HD1">I. Background</HD> DoD is proposing to revise the DFARS to implement section 1655(a) and (c) of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2019 (Pub. L. 115-232). Section 1655(a) prohibits DoD from acquiring products, services, or systems relating to information or operational technology, cybersecurity, industrial control systems, or weapon systems through a contract unless the offeror or contractor provides disclosures related to sharing source code and computer code with foreign governments. Section 1655(c) requires contracts for those products, services, or systems to include a clause requiring the disclosures during the contract period of performance if an entity becomes aware of information requiring disclosure. The first part of the disclosure is related to whether, after August 12, 2013, the entity making the disclosure has allowed, or is under an obligation to allow, a foreign government to review the code of a noncommercial product, system, or service developed for DoD. The second part of the disclosure pertains to whether, after August 12, 2013, the entity making the disclosure has allowed, or is under an obligation to allow, a foreign government in a list required by section 1654 of the NDAA for FY 2019 to review the source code of a product, system, or service that DoD is using or intends to use. The third part of the disclosure is related to whether the entity making the disclosure holds or has sought a license pursuant to the Export Administration Regulations (15 CFR chapter VII, subchapter C), the International Traffic in Arms Regulations (22 CFR chapter I, subchapter M), or successor regulations, for information technology products, components, software, or services that contain code custom-developed for the noncommercial product, system, or service DoD is using or intends to use. Once the disclosures are provided to DoD, and if the Secretary of Defense determines that the disclosure relating to a product, system, or service entails a risk to the national security infrastructure or data of the United States, or any national security system under the control of DoD, section 1655 requires the Secretary to take such measures as the Secretary considers appropriate to mitigate such risks. In addition, as the Secretary considers appropriate, the Secretary may condition any agreement for the use, procurement, or acquisition of the product, system, or service on the inclusion of enforceable conditions or requirements that would mitigate such risks. <HD SOURCE="HD1">II. Discussion and Analysis</HD> This proposed rule includes a new subpart, 239.7X, Disclosure of Information Regarding Foreign Obligations. Section 239.7X00 describes the statutory requirement implemented in the new subpart. Section 239.7X01 includes new definitions of computer code, open source software, and source code. The new subpart includes the section 1655 prohibition at 239.7X02. Section 239.7X03 clarifies that the prohibition does not apply to open source software. A section on procedures was added at 239.7X04 to require contracting officers to validate in the Catalog Data Standard within the Electronic Data Access (EDA) system ( <E T="03">https://piee.eb.mil</E> ) that offerors or contractors have completed all foreign obligation disclosures prior to awarding a contract or exercising an option. Section 1655 prohibits DoD from using a product, service, or system procured or acquired under certain awards unless foreign obligation disclosures have been made. This proposed rule requires completion of the foreign obligation disclosures prior to exercising an option to ensure DoD complies with the statutory intent. Section 239.7X05 provides prescriptions for a new solicitation provision and contract clause. The new provision is prescribed for use in solicitations that include the clause at 252.239-70ZZ, Postaward Disclosure of Foreign Obligations. The new clause is prescribed for use in solicitations and contracts, task orders, or delivery orders, for the acquisition of products, services, or systems relating to information or operational technology, cybersecurity, industrial control systems, or weapon systems, including those using Federal Acquisition Regulation (FAR) part 12 procedures for the acquisition of commercial products and commercial services. The purpose of the provision at 252.239-70YY, Preaward Disclosure of Foreign Obligations—Representation, is to notify offerors that they will be required to make disclosures within the Catalog Data Standard in the Electronic Data Access (EDA) system ( <E T="03">https://piee.eb.mil</E> ) in order to be eligible for award. While there are three distinct disclosures, the provision identifies the first and second disclosures in one paragraph at 252.239-70YY, paragraph (c)(1), for clarity. The third disclosure is identified at paragraph (c)(2). This provision includes a requirement for all offerors to represent by submission of the offer that the information on the foreign disclosures the offeror has made within the Catalog Data Standard in EDA is current, accurate, and complete. The purpose of the clause at 252.239-70ZZ, Postaward Disclosure of Foreign Obligations, is to require contractors to maintain their disclosures in the Catalog Data Standard within EDA and flow down the requirement to maintain disclosures in the Catalog Data Standard within EDA to subcontractors. Similar to the provision, while there are three distinct disclosures, the clause identifies the first and second disclosures in one paragraph at 252.239-70XX, paragraph (b)(1), for clarity. The third disclosure is identified at paragraph (b)(2). The clause also requires contractors to require their subcontractors to complete foreign obligation disclosures in the Catalog Data Standard in EDA prior to awarding the subcontract. Language was added at part 212 to apply the provision and clause to the acquisition of commercial products and commercial services. In part 213, language was added to apply the requirement to disclose foreign obligations will be applied at or below the micro-purchase threshold. Language was also added at part 217 to instruct the contracting officer exercise options only after verifying in the Catalog Data Standard in the EDA system ( <E T="03">https://piee.eb.mil</E> ) that all disclosures have been completed. <HD SOURCE="HD1">III. Applicability to Contracts At or Below the Simplified Acquisition Threshold (SAT) and for Commercial Services and Commercial Products, Including Commercially Available Off-the-Shelf (COTS) Items</HD> This proposed rule proposes a new provision and clause to implement the requirements of section 1655 of the NDAA for FY 2019: (1) DFARS 252.239-70YY, Preaward Disclosure of Foreign Obligations-Representation; and (2) DFARS 252.239-70ZZ, Postaward Disclosure of Foreign Obligations. The provision at DFARS 252.239-70YY is prescribed at DFARS 239.7X05(a) for use in solicitations that include the clause at DFARS 252.239-70ZZ. The clause at DFARS 252.239-70ZZ is prescribed at DFARS 239.7X05(b) for use in solicitations and contracts for the acquisition of products, services, or systems relating to information or operational technology, cybersecurity, industrial control systems, or weapon systems, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services. DoD does intend to apply the proposed rule to contracts at or below the SAT. DoD does intend to apply the proposed rule to contracts for the acquisition of commercial products including COTS items and for the acquisition of commercial services. <HD S ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Preview showing 10k of 40k characters. Full document text is stored and available for version comparison. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━