The Federal Communications Commission’s (FCC) update to its Covered List now includes consumer-grade routers made in foreign countries. The new rules, however, only apply to new device models and have other exceptions.
An executive branch interagency body convened by the administration found that the routers “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” They do so by introducing supply chain vulnerabilities and pose what the press release terms severe cyber security risks. The devices, the FCC says, could disrupt critical infrastructure and lead directly to hardships.
The FCC press release said that foreign-sourced routers were involved in the Volt, Flax, and Salt Typhoon cyberattacks that targeted vital U.S. infrastructure.
Exemptions from the Department of Defense and the Department of Homeland Security are available for routers that have been found to not pose unacceptable risks. The move by the FCC does not impact continued use of routers that have previously been acquired and does not prevent retailers from importing, marketing and selling that have been approved through the FCC’s equipment authorization process.
“I welcome this Executive Branch national security determination, and I am pleased that the FCC has now added foreign-produced routers, which were found to pose an unacceptable national security risk, to the FCC’s Covered List,” FCC Chairman Brendan Carr said in a press release.
The government previously acted to contain cybersecurity threats in equipment. Earlier in the decade, equipment from Huawei and ZTE were found to pose security threats and ordered removed. That led to the FCC’s “rip-and-replace” program, which became a flash point between the government and rural operators that said the program was underfunded.
In April, 2023, in 2023 senators John Hickenlooper (D-CO) and Deb Fischer (R-NE) had introduced the Defend Our Networks Act. This was aimed at helping rural operators replace equipment from Chinese vendors Huawei and ZTE that had been ordered out of U.S. networks due to such concerns.
