The FCC just voted to block the sale of consumer Wi-Fi routers made by foreign entities. A new public notice cites cyberattacks such as Volt, Flax, and Salt Typhoon for motivation to ban foreign-made routers.

This didn't come out of nowhere. It's the latest move in a multi-year federal push to lock down home network infrastructure:

• 2022: FCC bans new equipment authorizations for Huawei and ZTE

• 2024: U.S. Gov. Disrupts China-linked Botnet Targeting EOL Cisco and Netgear Routers

• 2025: Congressional request for investigation into TP-Link

So your home router is now instrumental to national security. But what does this bulletin actually mean for people at home?

Per the FAQ on the covered list changes, you don’t need to chuck your current router out a window today. These changes do not affect previously purchased devices. This change affects vendors seeking to certify new devices with the FCC:

A logical next question then is what constitutes a foreign-produced router. Here’s the exact definition: “Production generally includes any major stage of the process through which the device is made, including manufacturing, assembly, design, and development.”

That’s basically every router out there, no? Even if the company is legally incorporated in the U.S., their components and assembly occur in many places abroad, such as Taiwan, China, and Vietnam. That doesn’t even cover remote engineering and design teams based outside the U.S.

Later on, the document notes that affected router producers can apply for conditional approval for 18 months provided they address any U.S. national security concerns.

To be clear, this does not affect enterprise-grade equipment. Specifically, the public notice defines routers as “to include consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer.” However, the bulletin covers residential equipment installed by an ISP or other professional that users can still install themselves. MDU-specialized businesses could have their services impacted depending on how the FCC practically defines “can install themselves.” If your infrastructure has unnecessarily complicated features, then congratulations; this bulletin doesn’t apply to you.

Besides vendors with unnecessarily complicated features? Vendors such as Ubiquiti ride a fine line between enterprise and consumer-grade; how they and similar vendors benefit may depend on the level of professional involvement required to deploy new gear they’re looking to certify. If anyone can go buy and set up a router without talking to someone, for at least licensing, they likely have to comply with the new bulletin going forward.

Unless companies out there entirely build their devices from vendors such as Intel, Micron Technology, and Texas Instruments based in the U.S., it’s too early to tell.

While I strongly empathize with the importance of national security, this bulletin makes conducting business in the U.S. more difficult. Generally, I don’t support measures that strongly limit trade and business activities. A broad, sweeping ban on foreign-made consumer routers feels lazy compared to simply revoking the certification abilities of parties that jeopardize national interests or have major security flaws. Remember, bot nets and salt typhoon attacks happened on already purchased equipment, and even legacy equipment.

The ambiguity in what constitutes consumer-grade based on installation complexity will cripple travel router manufacturers and other vendors. Even if companies manage to get conditional approval, the approval only lasts for 18 months. I wonder if consumers will walk into Target five years from now and see only one or two router options to purchase.

It’s no wonder the networking world has been flabbergasted by this news. The real effects come down to how the FCC practically implements these rules, and that we will not know for some time. I’d watch for this and who ends up making the covered list of exemptions. So far, this list comprises of mostly drone companies. Give the full bulletin a read and let me know what you think.

Until next week,
Eva