FCC bans import of new foreign-made consumer routers due to security risks

The Federal Communications Commission has ordered a ban on imports of new consumer routers manufactured overseas, citing cybersecurity risks.

The order, released late Monday, states that the import ban “includes all consumer routers manufactured in foreign countries.” The FCC said the order does not affect the import or use of existing routers, but exceptions could be made for new equipment if approved by the Department of Defense or Homeland Security.

The FCC argued that foreign routers “pose an unacceptable risk” to U.S. national security, citing threats from Chinese-backed hacker groups Bolt, Salt, and Flux Typhoon.

According to Reuters, China is said to have about 60% of the market for consumer routers that connect homes and businesses to the Internet.

The FCC said it is taking action because malicious hackers are exploiting flaws in foreign routers to attack American homes, disrupt networks and enable cybercrime and surveillance.

Both government-sponsored hackers and cybercriminals have long targeted routers that allow access to home and business networks. Hackers can also hijack routers and attack other companies and businesses with destructive events aimed at overloading servers with junk network traffic, known as distributed denial-of-service attacks.

The FCC provided no evidence that consumer routers made in the United States are more secure than routers developed overseas. An FCC spokesperson did not respond to a request for comment.

Salt Typhoon is a Chinese-backed spy group that has hacked into dozens of telephone and internet companies around the world, including the United States, and is known to have exploited vulnerabilities in routers made by American network giant Cisco. Another Chinese-backed hacking group, Flax Typhoon, which U.S. authorities have accused of running a large botnet of hijacked devices, has hacked at least 126,000 devices in the U.S. and thousands more around the world, targeting both U.S. and foreign routers.

FCC Chairman Brendan Carr said in prepared remarks that the agency “will continue to operate.” [sic] Our role is to ensure the security of America’s cyberspace, critical infrastructure, and supply chain. ”

Despite a spate of Chinese hacks targeting U.S. companies and government agencies, Carr was one of two FCC commissioners who voted in November to repeal cybersecurity rules that require carriers to protect their lawful interception systems from unauthorized intrusion.