- cross-posted to:
- usa@midwest.social
608
- cross-posted to:
- usa@midwest.social
BrianKrebs (@briankrebs@infosec.exchange)
infosec.exchangeWhoa, that escalated quickly. This just got sent out by the press folks at the Federal Communications Commission (FCC). The FCC says it has decided that all foreign-made consumer-grade Internet routers are henceforth prohibited from receiving FCC authorization and are therefore prohibited from being imported for use or sale in the United States.
"Update Follows Determination by Executive Branch Agencies that Consumer-Grade Routers Produced in Foreign Countries Threaten National Security
WASHINGTON, March 23, 2026—Today, the Federal Communications Commission updated its Covered List to include all consumer-grade routers produced in foreign countries. Routers are the boxes in every home that connect computers, phones, and smart devices to the internet. This followed a determination by a White House-convened Executive Branch interagency body with appropriate national security expertise that such routers “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.”
"The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.”
"This action does not affect any previously-purchased consumer-grade routers. Consumers can continue to use any router they have already lawfully purchased or acquired."
"Producers of consumer-grade routers that receive Conditional Approval from DoW or DHS can continue to receive FCC equipment authorizations. Interested applicants are encouraged to submit applications to conditional-approvals@fcc.gov."
Not sure how many consumer-grade routers will be left for sale if it really is a ban on approvals for any foreign-made consumer routers like they said, and not just a bunch of already restricted Chinese makers like Huawei and ZTE.
https://www.fcc.gov/document/fcc-updates-covered-list-include-foreign-made-consumer-routers
FCC's "covered list" of "thou shalt not entities": https://www.fcc.gov/supplychain/coveredlist
This only applies to routers.
It’s not widely known outside the ham radio community, but part of the 2.4GHz wifi band overlaps the 13cm amateur radio band. If you turn off 5GHz wifi and lock the 2.4GHz AP to Channel 1, it qualifies as a ham radio, and can be sold as a ham radio instead of an AP/Router. You do need a ham radio license to operate it as a Ham AP, but you do not need a license to buy a Ham AP.
If the end user wants to turn on 5GHz after the fact, there is not a damn thing the FCC can do about it.
That deals with the need for a WiFi access point, but not the main router functionality. Another approach would be a low-power PC running OPNsense or PFsense with a WiFi card repurposed as an access point. Or, if the new policy concerns only routers and not access points, a PC for the router plus a dedicated WiFi access point (some device that is not capable of being a router).
But you can’t run encryption on it. So that means no WEP, no WPA, no SSL, TLS, VPN, etc.
So yes, while you could run your own wireless access point, it doesn’t solve the main requirement for most people which is privacy.
You aren’t understanding my point.
My point is that you can continue to import and sell the exact same physical device, just with a little change in marketing, and possibly software.
My point is this: Once you have acquired the device, there is fuck all the FCC can do about you converting your “ham radio” back into a consumer-grade router.
This is technically not true, the FCC can and does enforce spectrum usage rules. Whether they will expend resources chasing down your router or your unlicensed GMRS is another matter.
Lol nice