The Federal Communications Commission’s Covered List now includes all internationally manufactured home routers, effectively prohibiting the sale of new models within the United States.

The Covered List, established by the Secure and Trusted Communications Networks Act of 2019, is a register maintained by the FCC of communications equipment and services deemed by the U.S. government to present an unacceptable threat to national security or the well-being of Americans.

Previously, the list only featured specific products and companies associated with security risks, such as Kaspersky, Huawei, ZTE, Hikvision, and Dahua.

The expansion of the Covered List to encompass all routers produced overseas follows a National Security Determination issued on March 20 by a group representing the Executive Branch.

The assessment stated that routers made in other countries create a supply-chain vulnerability “that could disrupt the U.S. economy, critical infrastructure, and national defense.” The agency also concluded that these devices could be leveraged “to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.”

To justify the decision, the FCC points out that foreign-built routers were instrumental in the Volt, Flax, and Salt Typhoon hacker attacks, which targeted vital U.S. infrastructure.

Limited approval has been given to specific routers employed by the U.S. Department of Defense (DoD) or the Department of Homeland Security (DHS) in drone systems, as these were deemed not to constitute a security threat.

Moreover, the updated regulations do not prevent foreign consumer-grade router manufacturers from seeking authorization to sell in the U.S., provided they openly declare:

• The structure of their corporate and ownership, including any financial support or influence from foreign governments.
• Details regarding manufacturing and supply chains, encompassing bills of materials, country of origin for all parts, specifics on intellectual property ownership, locations for manufacturing and assembly, and the origin of software or firmware.
• Their strategy for shifting critical components manufacturing to the U.S., along with a description of any existing production or assembly activities already based in the United States.

For average consumers within the United States, these new regulations are unlikely to have an immediate impact, as existing router models will continue to be available for purchase.

Regarding Unmanned Aircraft Systems (UAS) and their key components, the FCC has stated that they will permit software and firmware upgrades until at least January 1, 2027.

It may become more challenging for U.S. consumers to access newer router models, and these products may also become more expensive, due to the added complexity and expense of regulatory approval.

Considering that testing, approvals, and FCC certification typically require a few months, even under ideal conditions, this could potentially delay entry into the U.S. market.

Some manufacturers might also decide that pursuing the alternative certification route is not worthwhile, especially given the requirement to move production to the U.S., which would result in reduced model availability due to exiting the U.S. market.