The United States Federal Communications Commission has announced overnight sweeping bans on foreign-made consumer-grade routers, essential devices for home network connectivity.
“This followed a determination by a White House-convened Executive Branch interagency body with appropriate national security expertise that such routers ‘pose unacceptable risks to the national security of the United States or the safety and security of United States persons’,” the FCC said in a March 23 fact sheet.
The determination found that routers made outside the US – which is the vast majority of consumer routers – introduce a “supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defence”.
The Executive Branch also determined that such hardware poses a “severe cybersecurity risk” that could lead to disruption of critical infrastructure and US citizens.
The FCC’s ruling also referenced the Trump administration’s 2025 National Security Strategy, which said: “the United States must never be dependent on any outside power for core components – from raw materials to parts to finished products – necessary to the nation’s defence or economy”.
“We must re-secure our own independent and reliable access to the goods we need to defend ourselves and preserve our way of life.”
According to the FCC, foreign-made routers were used by several China-nexus threat actors in their campaigns on US soil.
However, the new ruling does feature a carve-out that may allow some router makers to make arrangements with the government.
“The determination included an exemption for routers that the Department of War (DoW) or the Department of Homeland Security (DHS) have granted ‘Conditional Approval’ after finding that such device or devices do not pose such unacceptable risks,” the FCC said.
“Producers of consumer-grade routers are encouraged to submit an application for Conditional Approval using the guidance attached to the determination.”
Brendan Carr, chairman of the FCC, said he was pleased with the Executive Branch’s ruling.
“I welcome this Executive Branch national security determination, and I am pleased that the FCC has now added foreign-produced routers, which were found to pose an unacceptable national security risk, to the FCC’s Covered List,” Carr said.
“Following President Trump’s leadership, the FCC will continue to do our part in making sure that US cyberspace, critical infrastructure, and supply chains are safe and secure.”
The Covered List referred to by Carr is a “list of communications equipment and services (Covered List) that are deemed to pose an unacceptable risk to the national security of the United States or the security and safety of United States persons”. The first entry in the list, dated March 2021, is any telecommunications equipment produced by Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology, and Dahua Technology Company.
Kaspersky products were also added soon after, alongside China Mobile and China Telecom.
The newest entry simply reads “Routers produced in a foreign country, except routers which have been granted a Conditional Approval by DoW or DHS”.
The ban does not cover routers already purchased by US consumers, nor does it restrict the sale of devices already given FCC approval. The restrictions only apply to new model devices.
Reactions
More than one observer has questioned the FCC’s move, with cyber security researcher Brian Krebs pondering what router models may be left on the shelves following the ban.
“Not sure what the Federal Communications Commission (FCC) is thinking here, because banning US consumers from buying consumer-grade routers from hardware makers outside the US doesn't exactly leave them with many options,” Krebs said in a post to LinkedIn.
“Not sure how many consumer-grade routers will be left for sale if it really is a ban on approvals for any foreign-made consumer routers like they said, and not just a bunch of already restricted Chinese makers like Huawei and ZTE.”
Rob Ricci, Research Professor in the Kahlert School of Computing at the University of Utah, suggested that the restrictions could in fact be more focused asserting influence than banning potentially dangerous devices, however.
“I suspect the actual reason for this is in the second half of the sentence,” Ricci said, referring to the below quote:
"... or receive an exemption from the Pentagon or Homeland Security Department."
“We've seen this administration use approval processes to extract all kinds of concessions out of companies; see its use of approval over mergers to get media companies to do its bidding,” Ricci concluded.
David Hollingworth
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.