The vast majority of wireless routers used in homes (and many small businesses) in the United States is now banned from being imported into the US. Yesterday, the Federal Communications Commission (FCC) ruled that routers manufactured outside of the US “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.”
The agency yesterday banned the import and sale of all internet routers manufactured outside of the US, saying:
“The Executive Branch determination noted that foreign-produced routers (1) introduce ‘a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense’ and (2) pose ‘a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.'”
The ruling follows a report that thousands of routers sold by Asus had been infected with malware, turning the affected routers into a botnet. In addition to Asus, routers sold by Cisco, D-Link, and Linksys were also targeted by the botnet.
Last year, it was announced that investigators at three US government agencies – the Commerce, Defense and Justice departments – had begun a probe into TP-Link routers, which currently hold a 65% market share in the US home and small business router market. The router is popular among more than 300 internet service providers, who often supply badged versions of the company’s routers to customers.
The routers are also the top choice on Amazon, and are even used by the US Defense Department and other federal government agencies.
TP-Link has long been the target of criticism due to its lack of updates to plug security holes in the routers’ firmware. The routers’ popularity among ISPs and government agencies makes the lack of security updates especially concerning. Investigators said TP-Link routers had been turned into a botnet designed to carry out cyber attacks on US organizations and suppliers, including the Department of Defense.
Since the vast majority of routers sold in the US are affected by the ruling, the new ruling makes it illegal to import nearly every router used in homes across the US. This also affects the routers provided by internet service providers (ISPs), meaning ISPs will be required to switch to US-made models.
So, I Can’t Buy a New Router?
While the ban affects nearly all routers popular with US consumers, all existing inventory in the US can continue to be sold until supplies are depleted. Any routers currently in use can continue to be used. (But I strongly recommend checking for firmware and software updates for your router, to possibly plug some of the security holes the US government is concerned about.)
However, this that ISPs are likely to have problems in providing routers to new customers. So, those of you that are considering new internet service or a change in providers will want to contact the ISP to confirm that they still have a supply of new routers on hand.
Can I Continue to Use My Router?
While new devices on the covered list are prohibited from being imported for use or sale in the U.S., it does not prohibit the use of routers already in use. This means that even if your router is now banned from sale in the US, you can continue to use it.
Strangely enough, the ban does not restrict the import or sale of routers for the exclusive use by the federal government.
Can Router Makers Apply for an Exemption to the Ban?
The router ban is wide-ranging, thanks to the definition of a “foreign-made” router in the new ruling, which states “that “Production generally includes any major stage of the process through which the device is made, including manufacturing, assembly, design, and development.”
While router makers can attempt to receive an exemption to the ban by proving that their devices are safe. However, the exemption process is complicated.
