On Friday, the FAR Council issued an interim rule intended to prevent federal agencies from agreeing to terms of service (TOS) agreements and End User License Agreements (EULAs) with open-ended indemnification clauses.1 The interim rule, which is effective immediately, is specifically aimed to curb the practice of contracting officials agreeing to such indemnification provisions in standard contracts for web-based social media applications. The rulemaking is a reminder that although President Obama’s Administration consistently has pushed agencies to take advantage of the unique benefits presented by social media, including opportunities for greater openness, transparency, and engagement of the public, that enthusiasm is tempered by the reality that the Government will not agree to certain contract terms that are standard in the commercial space, and even when its officials agree to those terms, some of them may be unenforceable.
The Anti-Deficiency Act generally prohibits agencies from entering into contracts or other obligations in advance of or beyond the scope of appropriated funding.2 In other words, contracting officers and other government employees cannot bind an agency to contractual commitments (including indemnification obligations) that exceed the amounts Congress has appropriated to that agency. Congress has created certain exceptions to the Anti-Deficiency Act’s general prohibition. One of the most important statutory exceptions is Public Law 85‑804,3 which allows the President to authorize federal agencies to indemnify public contractors against “unusually hazardous or nuclear risks.”4 But the application of Public Law 85-804 and other exceptions is fairly narrow.
Even before the interim rule, the FAR prohibited contracting officers from violating the Anti-Deficiency Act.5 And courts generally have found that the Anti-Deficiency Act prohibits indemnification absent express statutory or regulatory authority.6 There has been growing concern, however, that contracting officers have not fully understood the nature of the prohibition and, in some cases, have unknowingly fallen afoul of it.
The impetus for this rulemaking can be traced back to a June 2011 letter from the Department of Commerce (Commerce) to the Department of Justice (DOJ) seeking the DOJ’s views on the application of the Anti-Deficiency Act to TOS agreements for social media applications.7 In response, the DOJ Office of Legal Counsel (OLC) issued an opinion indicating that the Anti-Deficiency Act is violated when a contracting official or other employee with authority to bind the Government agrees, without statutory authorization or an applicable exception, to an open-ended, unrestricted indemnification provision. The OLC opinion, and the Commerce letter that prompted it, focused specifically on web-based TOS agreements, such as “clickwrap” and “browsewrap” agreements. The Opinion describes a situation in which a Government official holding a purchase card consents to an online TOS agreement containing an open-ended indemnification clause in the course of registering for an account with a commercial social media service, and the Government, under the TOS, holds the service provider harmless for damages caused to a third party when the Government uses the application. The contracting officer’s agreement to such TOS creates an immediate Anti-Deficiency Act violation insofar as the agency, upon agreement to the indemnification provision, is legally liable—or at least potentially legally liable8—for an amount in excess of appropriations.
OLC’s opinion drew the attention of the Office of Management and Budget (OMB), which responded by recently issuing guidance to ensure agencies act in compliance with the Anti-Deficiency Act and OLC’s opinion.9 OMB’s guidance identifies several steps that agencies should take “to the extent appropriate” with respect to TOS agreements for social media. Specifically, it directs agencies to:
- Review the OLC’s memorandum;
- Consult with agency counsel before agreeing to any TOS agreement;
- Conduct an inventory of social media applications currently in use and maintain a record of signed TOS agreements;
- Check the General Services Administration’s (GSA’s) list of approved social media applications;
- Coordinate with GSA when negotiating with social media providers; and
- Review the TOS applicable to the agency’s use of software and other information technology or internet products and services beyond social media.
GSA’s list of “Federal-friendly social media agreements” is available online at http://www.HowTo.gov/TOS.10 GSA will negotiate with companies to try to reach agreement on terms acceptable to the Government, and if the negotiation is successful, GSA will include the company’s TOS on its approved list. OMB’s guidance also directs the FAR Council to develop regulations to address the Anti-Deficiency Act risks identified by the OLC, leading to the issuance of the interim rule last week.
Details of the interim changes to the FAR
The interim rule introduces a new clause, FAR 52.232-39, Unenforceability of Unauthorized Obligations, which it prescribes for all federal acquisitions, including those below the micro-purchase threshold.11 The rule imposes the same restriction on commercial-item contracts through the addition of a new paragraph (u) to the standard commercial-item clause, FAR 52.212-4, Commercial Terms and Conditions—Commercial Items.12 FAR 52.232-39 and paragraph (u) of FAR 52.212-4 provide that unless authorized by statute and “specifically” authorized under the procuring agency’s rules, a clause requiring the Government to indemnify the contractor for any loss or liability that would create an Anti-Deficiency Act violation is unenforceable against the Government. The assertions of unenforceability in these clauses are consistent with case law precedent in this area.13 The clauses further provide that an unenforceable indemnification provision is severable from the balance of the parties’ agreement and will be read out of the contract.14 Apparently not comfortable with the statement that such agreements are unenforceable and stricken from the contract, the FAR Council also included a contractual disclaimer that the Government will not be deemed to have agreed to the offending provision:
Neither the Government nor any Government authorized end user shall be deemed to have agreed to such clause by virtue of it appearing in the EULA, TOS, or similar legal instrument or agreement. If the EULA, TOS, or similar legal instrument or agreement is invoked through an “I agree” click box or other comparable mechanism (e.g., “click-wrap” or “browse-wrap” agreements), execution does not bind the Government or any Government authorized end under to such clause.15
In addition to the clauses, the interim rule also adds guidance to various parts of the FAR. Interestingly, much of the new regulatory text is more instructional than typical FAR provisions. For example, FAR 37.703-2 reads more like general guidance or background than a regulation:
Many supplies or services are acquired subject to supplier license agreements. These are particularly common in information technology acquisitions, but they may apply to any supply or service. For example, computer software and services delivered through the internet (web services) are often subject to license agreements, referred to as End User License Agreements (EULA), Terms of Service (TOS), or other similar legal instruments or agreements. Many of these agreements contain indemnification clauses that are inconsistent with Federal law and unenforceable, but which could create a violation of the Anti-Deficiency Act (31 U.S.C. 1341) if agreed to by the Government.16
One of the purposes of this exposition is obviously to educate contracting officers, but OMB and the FAR Council also intend for it to put contractors and prospective contractors on clear notice that these types of online TOS agreements are not welcomed.17
Implications of the interim rule
The interim rule, in a sense, merely confirms the status quo—a contractual obligation generally cannot be enforced against the Government if it exceeds appropriated funding. As a practical matter, however, the rule is likely to make contracting officers even more reluctant to agree to standard TOS for web-based applications, especially clickwrap and browsewrap agreements. Contractors, therefore, should be prepared to respond to agencies unwilling to agree to their standard TOS. At the same time, contractors should objectively assess which of their standard terms may not be enforceable even if the Government agrees to them.
Government agencies are not strictly forbidden from agreeing to indemnification provisions in all situations, and contractors should understand the type of indemnification provisions and other commercial contract terms that are enforceable or that have a greater chance of being enforced. Generally, an indemnification provision will be upheld where the potential liability to the United States is limited to an amount that is known at the time of the agreement and within the amount of available appropriations.18 Accordingly, unless an Anti-Deficiency Act exception applies, contractors should craft their indemnification provisions, to the extent possible, to (a) limit the Government’s liability to the amount of appropriated funds available at the time of payment, and (b) disclaim any expectation that Congress will appropriate additional funds to meet any deficiency in the event of loss.
Contractors holding existing contracts with indemnification provisions should assess whether those provisions are enforceable. Even if a provision is not enforceable or there is some doubt surrounding enforceability, the contractor should not necessarily resign itself to agreeing to remove the provision without consideration. While being mindful of the Government’s right to terminate for convenience, a contractor may be in a position to request a concession from the Government, such as a price increase, in exchange for removing or revising an indemnification provision that the Government previously agreed to. Even assuming an indemnification provision or other clause of an online TOS agreement or EULA is contractually unenforceable, that does not necessarily mean the contractor would have no recourse against the Government. Indeed, the OLC’s opinion acknowledges that agencies are required to remove “unenforceable” indemnification provisions because such provisions can create liability for the Government, including under equitable theories such as quantum meruit.19
Finally, while the interim rule focuses on open-ended indemnification provisions in TOS agreements and EULAs, the commentary accompanying the rule indicates that the FAR Council is considering further rules to address other standard commercial terms that create risks of potential Anti-Deficiency Act violations. The FAR Council hinted that it may target commercial terms that provide for automatic renewals, such as subscription services. Automatic renewals can raise concerns about potential Anti-Deficiency Act violations where the Government is obligated to make payment for additional supplies or services in advance of appropriations.20 Likewise, as mentioned above, OMB’s guidance already directs agencies to review TOS agreements and EULAs for software, cloud computing, and other information technology that falls outside the context of online social media applications. Contractors, therefore, should be prepared to defend their standard terms in any context in which contracting officers may question whether those terms are consistent with federal law and the FAR.