Banned from the market, still on the wall: the FCC’s equipment order and the installed base
The FCC’s November 2022 order stopped new authorizations for Huawei, ZTE and, for security uses, Hikvision, Dahua and Hytera gear. It said nothing about devices already installed, so the agency’s inventory, not the market, became the enforcement point.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On November 25, 2022, the Federal Communications Commission released an order, adopted earlier that month under the Secure Equipment Act of 2021, that stopped it from authorizing new communications equipment from Huawei and ZTE. Video surveillance and two-way radio equipment from Hikvision, Dahua and Hytera was also barred from new authorization when used for public safety, government facility security, critical infrastructure surveillance or other national security purposes. The rules reached subsidiaries and affiliates. Without an FCC authorization, new models cannot lawfully be imported or marketed in the United States. The order did not revoke existing authorizations or require anyone to remove installed devices. That installed base stayed under older rules, chiefly Section 889 of the defense authorization act for fiscal 2019, which bars federal agencies from buying such equipment or contracting with companies that use it.
Most coverage treated the order as a trade and telecom story. For a public agency, its practical effect was narrower and harder. A rule about what could be sold next left the risk in what was already bolted to walls and poles. Agencies faced three distinct exposures, each governed by a different rule and each needing a different control: what they buy next, what they already own, and what their contractors and grantees run on their behalf.
What agencies buy next
The forward-looking exposure was the easiest to close. Federal buyers had been barred from procuring covered equipment under Section 889 since August 2019. Once new models could not be authorized at all, mainstream distributors had a clear reason to drop them, and the FCC order largely reinforced an existing federal rule.
The gap was relabeling. Low-cost cameras and network video recorders are often sold under other brands while running on hardware or firmware from a covered manufacturer. A clause that names five companies does not tell a buyer what is inside a box sold under a sixth name. Supplier self-certification shifts that question to a reseller who may not know the answer either.
Three controls work better. First, require bidders to name the original manufacturer of each device and of its main components, such as the system-on-chip and the camera module, with an inaccurate statement treated as a material breach. Second, ask for firmware provenance, since a device’s update server reveals its origin faster than its label. Third, give acquisition staff a short list of red flags, such as prices well below comparable products or firmware updates delivered from overseas cloud services, that trigger a technical review before award.
What agencies already own
The installed base was larger and quieter. The order left existing devices legal to operate. Over the previous decade many state and local agencies, school districts, transit authorities and public hospitals had bought networked cameras and recorders without recording the manufacturer as a risk attribute. Facilities teams often bought them, not IT. Many sat on flat networks with default credentials and cloud management accounts nobody monitored.
What changed in November 2022 was that origin became a recognized federal risk signal. An agency that could not answer from its own records how many cameras it ran, who made them, what firmware they used and which network segments they could reach had no basis for deciding whether to replace, isolate or accept them. The first deliverable was an inventory that put operational technology beside laptops and servers, with manufacturer, firmware version, location, owner and network segment as fields.
Discovery tools help here. Passive network monitoring and device fingerprinting identify cameras by their traffic and management interfaces even when the label says something else. A one-time walk-through by facilities staff, matched against what the network sees, usually finds more devices than either source alone.
Isolation was the sensible interim answer. A camera that can reach only a dedicated recorder on its own segment, with outbound internet access blocked and vendor cloud features disabled, is a far smaller risk than the same camera on the general network. That work costs a fraction of replacement and reduces risk regardless of who made the device. Replacement could then follow the normal refresh cycle, with covered devices retired first. An emergency removal after an incident or a new mandate costs far more, as the FCC’s own rip-and-replace program for small carriers showed while it waited years for full funding.
What contractors and grantees run
The third exposure was where agencies had the least visibility. Section 889’s second prohibition, in force since August 2020, bars federal agencies from contracting with any entity that uses covered equipment, whether or not it touches the contract. A contractor’s own offices, warehouses and data centers therefore become a compliance question for the agency that awards the work. Federal grant rules carry a parallel restriction on spending grant funds on covered equipment, which reaches state and local recipients and their subrecipients.
The annual representation in the System for Award Management is broad and self-reported. It does not substitute for asking a records-storage contractor, a managed security provider or a building-services vendor what is actually installed in the facilities that serve the agency. Program offices can add a short equipment questionnaire to onboarding and renewal, ask for the contractor’s own device inventory for covered sites, and reserve a right to audit.
Grant offices face a different mechanism. Recipients often buy cameras for schools, transit stations or public buildings with federal money. A single line in grant terms rarely reaches the integrator who installs the equipment. Requiring the recipient to keep invoices that name the original manufacturer, and sampling them during monitoring, puts the obligation where the purchase happens.
There is a trade-off. Every added representation raises the cost of doing business with government and narrows the field of small suppliers. Agencies that limited deep checks to contracts touching sensitive facilities or networks kept the burden proportionate.
With hindsight
The policy widened rather than reversed. In December 2024 the annual defense authorization act gave the FCC about $3.08 billion, through a Treasury loan to be repaid from spectrum auction proceeds, to close the rip-and-replace shortfall for carriers. On October 28, 2025, the FCC voted to close two gaps in its Covered List rules: it created a process to halt continued import and sale of previously authorized covered devices, and it barred authorization of covered modular transmitters built into other products. It also proposed extending the restrictions to a broader class of components. Each step moved the line closer to the installed base and to what sits inside a product. Agencies that had built operational technology into their asset inventories could answer each change quickly. Those relying on supplier representations kept finding covered devices during audits. Organizations should confirm current Covered List entries and contract clauses with counsel, since both have changed.