Federal Acquisition Supply Chain Security Act

The Federal Acquisition Supply Chain Security Act — FASCSA for short — is a US federal law from 2018. It determines which technology products the agencies of the American federal government are allowed to buy and which they are not. The core of the law is simple: if a product or a manufacturer is deemed a security risk to the state, it may not be built into government networks. The law is aimed primarily at hardware and software suspected of containing backdoors for espionage. It is part of a broader strategy to bring the so-called supply chain — that is, the path a product takes from manufacturer to end user — under state control.

Why supply chains become a security problem

Modern technology products consist of components from many different manufacturers around the world. A server in a US agency might contain chips from Taiwan, firmware from South Korea, and administrative software from China. At any one of these points, malicious code or a hidden surveillance function could theoretically have been built in — deliberately or through negligence.

This is exactly where FASCSA comes in. If an agency buys a product without checking its origin, it cannot be sure that foreign states are not eavesdropping on its own systems. This is not a theoretical scenario: American intelligence agencies have repeatedly warned that certain Chinese technology companies have close ties to the Chinese government and could therefore pose a risk.

The law therefore creates an institutional response: clear prohibitions, responsible agencies, and a process by which risks are systematically assessed and communicated. Without such a legal basis, each agency would have made these decisions on its own and at its own discretion.

How prohibitions and exceptions are regulated in FASCSA

The law grants several federal agencies — including the Department of Homeland Security and the Department of Defense — the authority to issue so-called exclusion orders. Such an order prohibits all federal agencies from purchasing or using a specific product or vendor. In addition, there are removal orders, which require that products already in use be removed from systems.

The decision as to who ends up on this list is based on a risk analysis. Factors such as a company’s ownership structure, possible state influence, and known vulnerabilities in products are assessed. This sounds like a technical process — but it is also a political decision, because it touches on trade relations and diplomatic ties.

Important: the law applies only to federal agencies, not directly to private companies. However, it has an indirect effect, because many companies seeking government contracts must comply with the same procurement rules.

FASCSA in practice: Huawei, ZTE, and the consequences

The best-known example of the law’s effect is the exclusion of the Chinese companies Huawei and ZTE from US government networks. Both companies are among the world’s largest providers of network equipment — the devices that make the internet possible in the first place. The US government classified both as a risk because, under Chinese law, they could be obligated to grant the Chinese government access to their devices.

The decision had consequences far beyond the United States. Allies such as the United Kingdom and Germany came under pressure to likewise exclude Huawei from building their 5G mobile networks. This shows how a national procurement law can trigger geopolitical debates.

In tech and AI news, FASCSA comes up whenever new vendors from the sphere of state-controlled economies come under scrutiny. The dispute over the video app TikTok and its Chinese parent company ByteDance also revolves around similar questions — even though TikTok itself is discussed under other laws. FASCSA provides the legal and conceptual framework that politicians and journalists repeatedly refer to in such debates.