FCC bans new routers made outside the USA over security risks

The Federal Communications Commission has taken decisive action by updating its Covered List to include all consumer routers manufactured in foreign countries, effectively prohibiting the sale of new models within the United States due to national security considerations.

This significant expansion of the Covered List—established through the Secure and Trusted Communications Networks Act of 2019—represents a comprehensive approach to addressing cybersecurity threats. The list serves as the FCC's official registry of communications equipment and services deemed to pose unacceptable risks to national security or American safety.

Previously, the list targeted specific entities and products with documented security concerns, including Kaspersky, Huawei, ZTE, Hikvision, and Dahua. The new policy dramatically broadens this scope to encompass all foreign-manufactured routing equipment.

This sweeping change stems from a National Security Determination issued March 20 by an Executive Branch interagency body, which conducted a thorough risk assessment of foreign-produced networking equipment.

The assessment concluded that foreign-manufactured routers present significant supply-chain vulnerabilities "that could disrupt the U.S. economy, critical infrastructure, and national defense." Furthermore, officials determined these devices could potentially be weaponized "to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons."

The FCC's decision draws support from documented evidence that foreign-made routers facilitated major cyberattacks, including those conducted by the Volt, Flax, and Salt Typhoon threat actors, which successfully targeted critical U.S. infrastructure systems.

Exemptions and alternative approval path

The new regulations include specific exemptions for certain use cases. Conditional approval has been granted to select routers deployed by the U.S. Department of Defense (DoD) and the Department of Homeland Security (DHS) for drone system operations, following security assessments that determined these devices pose minimal risk.

Importantly, the regulations don't completely bar foreign router manufacturers from the U.S. market. Companies can pursue approval through an alternative certification pathway, provided they meet comprehensive transparency requirements:

• Complete disclosure of corporate and ownership structures, including any foreign government financial backing or influence
• Detailed manufacturing and supply chain documentation, encompassing bill of materials, component origin countries, intellectual property ownership, manufacturing locations, and software/firmware origins
• Strategic plans for relocating critical component manufacturing to the United States, along with descriptions of existing U.S.-based production or assembly capabilities

Consumer impact

American consumers should experience minimal immediate disruption, as existing router models will continue to be available for purchase throughout the transition period.

For Unmanned Aircraft Systems (UAS) and their associated components, the FCC has established a grace period, permitting software and firmware updates through at least January 1, 2027.

However, consumers may face longer-term challenges in accessing new router models, potentially including increased costs as manufacturers navigate the additional regulatory requirements and compliance procedures.

The certification process typically requires several months for testing, approvals, and FCC authorization, even under optimal conditions. This timeline could result in delayed market entry for new router models.

Some manufacturers may conclude that the alternative certification pathway—particularly the domestic manufacturing requirements—presents insurmountable obstacles, potentially leading them to withdraw from the U.S. market entirely. This scenario could reduce the overall variety of router options available to American consumers.