According to the FCC, foreign-made internet routers were determined to be involved in recent cyberattacks that targeted vital infrastructure, including the Volt, Flax, and Salt Typhoon incidents.(Further information on the risks is contained in the FCC Public Notice, DA-26-278A1).
The interagency determination includes an exemption for routers that have obtained “Conditional Approval” from either the U.S. Department of War (DoW) or the Department of Homeland Security (DHS).
In practice, such routers cannot obtain new FCC equipment authorizations as needed for market access. For routers produced in USA, applicants must formally certify that the equipment is not 'covered'.
This restriction is based strictly on where product is produced, including its design, development, and assembly rather than the manufacturer's corporate identity.
Existing authorizations for covered routers remain valid unless revoked or limited by the FCC, but modifications including Class I permissive changes, are generally prohibited. However, to ensure device security and functionality, the Office of Engineering and Technology (OET) has issued a Blanket Waiver (DA 26-286). This waiver permits critical firmware and software updates, such as vulnerability patches and operating system compatibility fixes, through at least 1 March 2027.
The type of routers concerned is defined in the National Institute of Standards & Technology’s Internal Report 8425A to mean consumer-grade networking devices primarily intended for residential use and capable of being installed by the customer.
For example, a foreign produced wired ethernet router with no wireless functionality may still be considered covered if it can be installed at home or small office without professional assistance, while e.g. industrial routers that are not customer-installable would not be considered ‘covered’. Also a mobile phone with hotspot functionality is not considered ‘covered’, as its primary function is not a router. However, a foreign produced portable hotspot device which connects to WAN and recreates a Wi-Fi system would be considered ‘covered’ if intended for consumer use, due to the hotspot routing being its primary function.
A Conditional Approval procedure is available in Annex A in the Public Notice for applicants seeking exemption imposed by the restrictions or wishing to maintain FCC authorization while addressing national security concerns.
For further information, please see this blog or contact Vina.Kerai@nemko.com
(This article is based on the information provided by Vina Kerai; edited by T.Sollie)