FCC bans import of new consumer routers made overseas, citing security risks

In a significant move to enhance national cybersecurity, the Federal Communications Commission (FCC) has announced a ban on the importation of new consumer routers produced outside of the United States. This decision, made public late Monday, is driven by growing concerns over potential security vulnerabilities associated with foreign-manufactured devices. The FCC's directive extends to all consumer-grade routers sourced from abroad, although it does not impact the use of existing routers already in the country. New devices may still enter the market if they receive approval from the Departments of Defense or Homeland Security. The agency has expressed that routers sourced overseas present unacceptable risks to national security, particularly highlighting threats posed by China-linked hacking groups such as Volt, Salt, and Flax Typhoon. According to industry estimates, China dominates approximately 60% of the consumer router market, which plays a crucial role in connecting homes and businesses to the internet. The FCC's action is a response to incidents where malicious hackers have exploited weaknesses in these foreign devices, leading to attacks on American households, network disruptions, and enabling cybercrime and surveillance activities. Routers have long been a target for cybercriminals and state-sponsored hackers due to the access they provide to home and business networks. These hackers can commandeer routers to launch distributed denial-of-service (DDoS) attacks, overwhelming servers with traffic and causing significant disruptions. Notably, the FCC has not presented evidence suggesting that routers manufactured in the U.S. are inherently more secure than their foreign counterparts. An FCC spokesperson did not respond to inquiries regarding this matter. Among the cited threats, Salt Typhoon, a state-sponsored espionage group, has been implicated in breaches affecting numerous telecommunications firms globally, including those in the United States, by exploiting vulnerabilities in devices from American networking giant Cisco. Similarly, Flax Typhoon has been accused by U.S. officials of operating a vast botnet that has compromised over 126,000 devices nationwide, targeting both domestic and foreign routers. FCC Chairman Brendan Carr emphasized the agency's commitment to ensuring the safety and security of U.S. cyberspace, critical infrastructure, and supply chains. However, it is noteworthy that despite numerous Chinese cyberattacks on U.S. businesses and government entities, Carr was among the FCC commissioners who voted to eliminate certain cybersecurity regulations aimed at safeguarding telecom operators from unauthorized access to their systems.