US Bans Most Routers?

Hey everybody, it's Lon Sidman. You probably heard by now that the US government has effectively banned every new router from entering the US market. Now, any existing router that is already FCC approved, like this TPLink one here that you can find at Target, these will be allowed to be sold because they're not new, but anything new that might want to get an FCC approval now has to go through a process to get it. And we're going to dive into that right now.

Now before we dive into the topic, I do want to let you know that this video is being brought to you by all of you. That includes everyone who watches and subscribes to this channel on a regular basis along with those of you who have contributed to the channel either through my donor box page at lan. tv/support, through the YouTube membership program, through Patreon or floatplane, and of course through the super thanks that you can also do on these videos. I do appreciate everyone's support because watching and or contributing all help keep the lights on around here. and I do enjoy bringing this news and analysis to you. So, let's dive into this topic a bit. Now, this whole thing went down

last night. In fact, before the media started reporting on it, I did see this posted on the FCC's social media platforms. This fact sheet I found on Facebook, and this detailed the action on foreignade routers. And for a minute, I was thinking there's no way they could ban every single foreign router, but apparently they are. So there's going to be a lot of scrambling by every maker of routers to meet these requirements. But as you will see at the bottom here, the action does not prohibit the import, sale, or use of any existing device models. So for example, TPLink can continue making this model. They can continue importing these from overseas and they will not be affected by this new order. It's only new products that have to go back out for additional FCC certification. So the immediate impact is not significant. However, I'm sure many companies have products in the pipeline. All of those now we're going to have to meet this new order in some way, shape or form. They are providing a conditional approval and that can come from either the DO or the DHS. And if they get that conditional approval, and we'll talk about what the criteria are in a minute, then they will get authorizations for new products. But those conditional approvals require some commitment from the manufacturer that they're going to start making stuff in the US rolling forward. So there is a bit of a hurdle here for many of these companies to meet because they're going to have to at some point make equipment in the United States and give the government a commitment that they're going to do that. Now, many people thought that the US government was going to ban TPLink routers because that's been something both the Biden and this Trump administration have been considering. And that came because there were a number of vulnerabilities in uh some recent attacks that focused on TPLink products and they were concerned that perhaps the Chinese government put some kind of backdoor into these TPLink devices that could be exploited if there was ever a big conflict with China. And you think about how cheap and plentiful these things are across the US telecommunications network and how powerful the processors in these things can be for exercising uh attacks. That was the big concern of the government. But back in February, the government stepped back a little bit in the hopes of maybe tamping down some of the tension with China. And it looks like this new solution might be along those lines where they're just going to treat every router manufacturer equally and therefore they're not going to target any specific one. Now, you can find more

about this on the FCC's website at l. tv/ FCC routers. And the reasoning behind this, of course, is about a national security determination. On March 20th, uh the FCC received a national security determination regarding the unacceptable risks posed by routers produced in foreign countries. And the concern here is that we may have routers that have vulnerabilities on them, but there could also be routers that have vulnerabilities designed into them that could be exploited that may not be visible to the government. So they pointed to some examples of prior attacks like Vault, Flax, and Salt Typhoon cyber attacks. And these were very sophisticated attacks that had these software agents living inside of routers waiting to be executed. And so this is really the basis that they're making uh for this blanket ban. And if we dive into a uh US government press release from the prior administration, they talked about breaking up the Vault Typhoon network. And this was using privatelyowned SOHO routers just like this one here uh to create a botnet that could conceal uh the People's Republic of China as the origin of an attack against the US and other foreign victims. And these hacking activities included a campaign of targeting critical infrastructure organizations in the US. And if they're coming from somebody's router off of a cable modem somewhere, you'd never know what the source was because one command from overseas to all of these routers would then have the attacks originate from the routers themselves and it'd be hard to trace back where the attack originated from. What was most interesting about this typhoon case was that the vulnerable routers were at their end of life status. So the manufacturers kind of abandoned them and stopped doing firmware updates, but they were still connected to the internet somewhere. and that was how the exploits were uh taken

advantage of. Now, what was interesting about this case is that the government actually hacked those routers again to disconnect them from the botnet. So, you think about these folks who just had these old routers in their houses, had no idea that there was a cyber war going on inside of their home. But that's exactly what happened here. And I don't think this was the first time that the government actually proactively hacked into consumer products to protect them from an attack. And you'll see they did get a court authorization for this. That's in the last sentence there. And they did a bunch of things to first of all disconnect these devices from the botnet and then blocking additional communications to keep them off in the future. I do believe those who were impacted got notified after the fact by the government that they needed to maybe get rid of the router and perhaps that the government had been inside their network fixing things. Um, but this is the reality that we're in these days. So

why don't we talk about this covered list and what this means. So right now, every router, even if it's made by a US company, if that device is manufactured overseas, it is now on the covered list. And as of today, you can't import a new version of it. Again, the old ones are fine, but anything new that's up for FCC approval has to show that they've been granted some authority by the DOW or the DHS that they can be produced. So, right now on the list of exceptions, this is in the conditional approval section of the FCC's website, there is not a single router manufacturer that is currently compliant. And so, it's going to be a while, I think, before these companies get these conditional approvals. Right now, the only devices that have been granted such approvals are drones because there is a similar order now on foreignmade drone systems. And so we'll start seeing a very similar process here applied to routers. So what is that

process and what do manufacturers have to provide to the government to get their conditional approval here? Well, there is a document for that and you can find that at l. tv/outeronshore and there are a couple of things that they have to do. The first is they have to disclose their manufacturing and supply chain. That includes a detailed bill of materials for the router for which the applicant is seeking conditional approval. country of origin of all components. Entities responsible for IP ownership of the software updates for the router. Justification on why any foreign manufactured router is not currently manufactured in the United States, including why these foreign sources were selected and whether alternatives exist. Locations of manufacturing, final assembly, and testing. Because what we're seeing are a number of companies now, and I think presumably to avoid tariffs, have been making their products partially in China and then sending them over to another country for assembly. So, for example, this TPLink router, which is a Chinese company, has their products getting stamped with made in Vietnam for final assembly, and they're trying to get around uh some of those loopholes that were out there, at least on the tariff side. So, that's another issue. Country of origin for any onboard software and firmware. Quantitative assessment of supply chain concentration by country expresses both a percentage and production volume and identification of any single points of failure in the supply chain for the router including soul source suppliers, the country of those soul source suppliers and yada yada. And then they've got to do some other things. They have to come up with a plan for establishing manufacturing in the United States. So that requires a detailed timebound plan to establish that manufacturing process. a dedicated point of contact or office responsible for implementing the US manufacturing. A description of US-based manufacturing and assembly uh for the router, including the percentage of components that will be manufactured in the United States versus those coming from elsewhere, a description of committed and planned capital expenditures, and an inventory of the progress made on the US manufacturing and onshoring plan. So, this is not something that they can just commit to in the future. It looks like the government will hold them to it. Although that will depend on what administration comes after this one. But at least in the short term, they have to have real plans for onshoring their router manufacturing or else they will remain on the covered list and be unable to sell their products here in the US or import them. So what are the outcomes here? Well, I would hope one would be that we'll see less orphaned firmware because that was a big issue irrespective of whatever vulnerabilities might be built in. If you have routers that they stop making and stop supporting and customers are still using them, that becomes an issue. And who pays for that replacement of the router over time if the customer can't afford to do that? There's a lot of things that have to come into that. So perhaps we'll see less orphaned firmware in the future. Another concern though are government backd doorors here in the US because if we're finding the government is logging into people's routers and patching security vulnerabilities themselves even with a court order uh we could see a scenario where perhaps the government's going to require in all these top secret reviews of these plans some way for the government to get into these routers maybe to exercise search warrants or something else and that should be of concern and unfortunately those criteria will likely be opaque to the public. We'll have no idea. Uh but of course, as you know, with telecommunication companies, they did have to provide means by which the government could listen in on your phone calls, for example, with a court order. And it's possible that might be one of the requirements here that these companies have to agree to get

themselves off the list. Now, what about workarounds for those of us who like to do workarounds? Well, the first thing we need to do is figure out how the FCC defines a router for the purposes of this regulation. and they are following the national security determination and they are in turn relying on an NIST definition which says that a router is designed for a residential use and can be installed by the customer. Routers forward data packets most commonly IP packets between systems. But what about something like this? This is a computer. This computer happens to be made in China. Um, but this is not subject to the ban even though it has two Ethernet ports on board because its primary marketed purpose is not to be used as a router but rather as a computer. It can of course be turned into a router. If you have software installed like PFSense, for example, which is an open-source security platform, you could put it on here and this suddenly becomes a router. But because it's not marketed as such, it's not subject to that. And one could argue that open- source software like PFSense can be audited by the government. I am sure they have. So there's probably a better layer of security at least as far as the government is concerned about whether or not your pfSense router might get taken over by a backdoor. They could probably find the back door in the software. But there are ways to get around this and manufacturers might try. But if they try to market something as a router, that of course will then trigger the regulation and get them pulled off the market. So

what are some of the reactions to this so far? Well, PC Mag has been doing a good job collecting some and they've already heard from TPLink. I would bet you they're kind of relieved by this because everybody now is under the same rules that TPLink was thinking they would be under just on their own. And TPLink said they're confident in the security of their supply chain and they welcome the evaluation of the entire industry. Netgear also commented Netgear is a US-based company, but they market their products overseas. they may actually benefit the most from this because they could probably more easily spin up an a US-based uh presence given the fact that they're based in this country. And they commended the administration and the FCC for their action toward a safer digital future for Americans. A lot of times marketleading companies often welcome regulation that more heavily restricts their competitors. So I would imagine they would welcome uh what's going on here. So, I think in the short term, we'll definitely see Netgear products meet that list pretty quickly and perhaps others will follow in suit. So, that is the router ban in a nutshell. I'll keep an eye on this story. Overall, I'm not all that concerned about it. I think most companies will be able to demonstrate their security and get off of that covered list and onto the exception list in the short term. And we'll see how many companies over the next couple of years actually start basing their manufacturing operations here in the US. That will do it for this one. Until next time, this is Lon Simon.