Metro is no longer considering China’s state-owned rail-car manufacturer to build its next series of rail cars after Congress, concerned about cybersecurity risks, passed legislation prohibiting transit agencies from making such purchases.

President Trump signed the legislation into law just before Christmas.

“Congress took this issue seriously and took action in the recently passed defense bill, particularly since these rail cars will be used in our nation’s capital,” Sen. Mark R. Warner (D-Va.) said in a statement Friday. “There are credible security and foreign espionage issues associated with buying rail cars from a company controlled by the Chinese government — a government that’s tried to undermine U.S. competitiveness and national security.”

The legislation was prompted by China Railway Rolling Stock Corp. (CRRC), which was among the companies expected to bid on the contract to build Metro’s next-generation 8000-series rail cars, a deal potentially worth more than $1 billion.

The possibility that CRRC could win the contract raised concern among some security experts, members of Congress and Metro board members that the cars could be built with capabilities or access for the Chinese government to spy on the nation’s capital or launch cyberattacks. The worry was based in part on links the Justice Department has made between the communist government and previous hacking operations in the United States, as well as heightened tensions between the two countries over tariffs.

CRRC has won contracts to build rails cars for several U.S. transit systems in recent years, including in Chicago, Boston, Los Angeles and Philadelphia. Critics say that’s because the company is heavily subsidized by Beijing, which allows it to substantially underbid competitors. The likelihood that CRRC would have been the low bidder would have made it difficult for a crash-strapped Metro to turn down the company’s bid. The congressional action means the transit authority won’t have to make that decision.

The transit agency has not announced who will build the 8000-series rail car. Metro spokesman Dan Stessel said the selection process is still “active,” and that he could not release the names of the bidders, their countries of origin or how many bids had been submitted.

But more than 300 questions from potential bidders prompted Metro to push back the deadline for submissions by more than two months last spring. Transit officials also revised the requests for proposals to include security assurances because of the federal government’s cybersecurity concerns.

There are no rail-car manufacturers in the United States, and under the new congressional order, Metro can purchase only from domestic companies or companies based in countries sanctioned by the Tariff Act and Trade Act, both of which govern imports and trade to protect U.S. interests.

Though fewer than 20 U.S. cities have subway or “heavy rail” systems, it’s big business. Out of all public transportation spending in 2017, heavy rail investments accounted for nearly $7 billion, the largest capital expenditures out of all modes of public transportation, according to the most recent figures available from the American Public Transportation Association.

Metro’s newest rail cars, the 7000 series, cost $2 million apiece, including design, parts, training and warranty, the transit agency said. More than 700 have been delivered.

Metro is ordering more than 250 rail cars for its next series and has options to buy up to 800 as it phases out older-model cars and modernizes its fleet. The 8000 series will replace its 2000-series cars, which were built in 1982, and the 3000-series, which were built in 1987. The first shipment of 8000-series cars should arrive in 2024, Metro said.

The 8000-series cars will be Metro’s eighth model since the rail system opened four decades ago. Three of its first four models were made by Breda, a company that has since been sold to Hitachi Rail Italy. Kawasaki Heavy Industries Rolling Stock Company of Japan built the 7000 series at a plant in Lincoln, Neb.

Canada’s Bombardier has a $600 million contract to build rail cars for the New York Metropolitan Transportation Authority.

Other companies known to have shown interest in building Metro’s 8000 series include France-based Alstom, another former Metro rail-car maker that is building cars for Amtrak, and South Korea’s Hyundai Rotem.

CRRC has said that only the shells for its rail cars are built in China, while assembly is done at U.S. plants. At least 60 percent of the rail cars’ parts at its Chicago plant come from U.S. companies, it said.

It was three months after 11 CRRC representatives made a Metro-sponsored visit to the transit agency’s Greenbelt rail yard in January 2019, that Warner and Sen. Tim Kaine (D-Va.), as well as Sens. Chris Van Hollen (D-Md.) and Ben Cardin (D-Md.), proposed legislation that added as a condition to Metro’s important federal subsidy that it never buy from China.

The Rail Security Alliance, a five-year-old group funded by a rail trade group, freight car manufacturers and labor unions, which shared the same concerns as the senators, mounted a public awareness campaign with a petition, signs and lobbying of the region’s delegation.

Alliance spokesman Jeff Eller said it is the group’s belief that alleged underbidding on rail-car projects is part of Beijing’s long-term global strategy to drive competitors out of many business sectors and fill the vacuum as sole supplier of specialized products.

“I don’t want this to be construed that we’re against foreign [groups],” Eller said. “The government can subsidize the bids at a level that makes them nonmarket players. . . . It’s a bit of an unfair playing field.”

CRRC has contested the group’s claim, saying the bids it has lost are proof that it’s not out to monopolize markets. The company has called the software threat “ludicrous,” saying it has never controlled any of its cars once delivered.

In the end, lawmakers tacked an amendment onto the massive National Defense Authorization Act, which Trump signed in late December, that requires new rail cars come with cybersecurity certification. It also clearly delineates what countries are off limits for future business deals. Current, multiyear contracts were exempted and transit agencies were given two years to comply — except for Metro, which was specifically excluded to immediately stop any further overtures from CRRC.

CRRC had hired two public strategy firms to push back against the accusations, but last week, the company said the federal government’s condition on Metro federal funding killed its chances to land the 8000-series contract.

“CRRC is not in the running for [Metro],” said Dave Smolensky, a company spokesman.

The 8000 series is expected to build on the modernity and design of the 7000 series, which was a dramatic shift in design from past models. Phased into Metro’s fleet starting in 2015, the series features more space between seats, wider aisles and digital information screens. The 7Ks now make up more than half of the transit authority’s 1,100 working rail cars.

Planned upgrades for the 8000 series include digital system maps, real-time information for transfers, power outlets to charge phones, additional handholds and an improved announcement system, according to Metro.

Robert McCartney contributed to this report.