The Global Electronics Association (GEA) has released a scathing report which takes the Federal Communications Commission’s (FCC) approach to router security to task.
In March, an executive branch interagency body convened by the White House updated its Covered List to include consumer grade routers made in foreign countries. The Covered List aims to protect the United States against technology that poses security risks.
The Global Electronics Association report — “Routers, Restrictions, and Reality: The FCC’s Latest Supply Chain Curveball” — points to the size of the project and implies that it is unrealistic. It said there are more than 100 million consumer routers in the U.S., and the FCC program affects the replacement of each one. The GEA says that virtually no router used in the United States is manufactured here.
The report suggests the challenges are operational, not the result of the router technology. The intrusions such as the Salt Typhoon cyberattack were caused by “[i]nsecure defaults, exposed management interfaces, weak authentication, and above all, inadequate patching and end-of-life support are engineering and lifecycle failures.”
The report says that the Conditional Approval process — the only way for foreign routers to reach U.S. markets — is untested at the scale necessary to get the job done. The bottleneck would be exacerbated by the need for the Department of Defense and the Department of Homeland Security as well as the FCC to approve of new routers.
“The FCC’s decision to add all foreign-produced consumer routers to its Covered List represents a structural shift in how the United States regulates consumer technology,” reads the report.
“It is not a targeted action against a named adversary. It is a categorical restriction that touches every major router manufacturer, every broadband provider’s equipment pipeline, and ultimately every U.S. household that depends on a Wi-Fi connection. The scale of the affected market, more than 100 million devices in active use, tens of millions of units imported annually, and a replacement cycle that touches virtually every home and small business, makes implementation far more consequential than the drone precedent that preceded it.”
The GEA named other obstacles to the policy:
- The policy has an “implicit requirement” that a domestic production infrastructure be created in the United States. The industry now is based in Asia, and the 18 month requirement for creating one half a world away is without precedent, the report says.
- The Conditional Approval process is “an industrial policy in disguise.” It is “a reshoring mandate embedded inside a security framework, using the FCC’s equipment authorization system as the enforcement mechanism.”
- The FCC router action is the second application of a categorical, production-origin-based restriction. The first was the December 2025 drone ban. If this approach becomes the template for securing connected devices, the same problems will occur across every product category. These problems include “untested approval processes, unrealistic onshoring timelines, and a fundamental mismatch between the policy’s geographic proxy, and the engineering failures that drive actual exploitation.”
