New Rule Blocks Approval of Foreign Routers Without Federal Clearance
The U.S. Federal Communications Commission moved to significantly expand a supply-chain crackdown by effectively barring new foreign-made consumer routers from entering the U.S. market without federal approval.
See Also: Free Your IT Program of Tech Debt With an Enterprise Browser (eBook)
The FCC’s update to its Covered List prohibits the approval of new foreign-made consumer router models from entering the U.S. market following a determination by the White House that foreign routers “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” The action announced Monday cannot force consumers to stop using routers they already own and it does not automatically pull previously authorized models from shelves.
The agency’s Public Safety and Homeland Security Bureau said it was required to make the change after receiving a March 20 national security determination from a White House-convened interagency body, which cited supply-chain exposure and cyber risks in its notice. The order applies to all routers produced in a foreign country, though the FCC carved out a path for case-by-case “conditional approval” from the Departments of Defense and Homeland Security.
“Recently, malicious state and non-state sponsored cyber attackers have increasingly leveraged the vulnerabilities in small and home office routers produced abroad to carry out direct attacks against American civilians in their homes,” the national security determination that led to the update reads. “From disrupting network connectivity to enabling local networking espionage and intellectual property theft, foreign-produced routers present unacceptable risks to Americans.”
The policy extends to virtually all consumer-grade routers made abroad, unless national security officials later decide a specific device or class of devices does not pose any unacceptable risk. FCC officials said manufacturers seeking relief will have to disclose ownership, foreign influence, supply-chain details, software update controls and a time-bound U.S. manufacturing and on shoring plan.
Some reports indicate foreign-made routers account for roughly 60% of the U.S. home router market. The move comes amid growing scrutiny over firms like TP-Link, which has faced separate national security and competition concerns (see: Texas Sues TP-Link for Covering Up Chinese Manufacturing).
The FCC’s determination directly links the move to a series of Chinese cyber campaigns that federal officials have spent the last two years publicly warning about. The commission said foreign-produced routers were used in the Chinese nation-state intrusions, and argued that insecure edge devices provides foreign actors with potential footholds into homes, businesses, emergency services and critical infrastructure (see: CISA Directs Federal Agencies to Update Edge Devices).