US Cracks Down On Foreign Devices Citing Security Risk

The Federal Communications Commission is taking a hard turn on internet security, advancing a plan that could effectively shut out new foreign-made routers from the U.S. market amid growing concerns about cyber threats tied to overseas supply chains.

The proposal expands the FCC’s “covered list,” which blocks equipment deemed a national security risk. If implemented as outlined, new routers would either need to be manufactured in the United States or pass a strict national security review examining ownership, supply chains, and software control before being approved for sale.

Industry experts say that the standard may be impossible to meet in the short term.

“Effectively, the FCC would ban all new routers, because there are no domestic routers that meet that standard today,” said Matt Wyckhouse, CEO of cybersecurity firm Finite State. “There’s no one who can clear the bar right now.”

The move comes as federal officials warn that foreign-made routers have already been exploited in cyberattacks targeting Americans. According to the FCC, malicious actors have used vulnerabilities in these devices to infiltrate home networks, conduct espionage, and mask attacks on U.S. infrastructure.

Much of the concern centers on China-linked manufacturing. A large share of routers sold in the United States rely on Chinese engineering, components, or assembly, even when marketed under American or allied brands. That includes top-selling companies like TP-Link, which has faced increasing scrutiny in Washington.

Despite that scrutiny, TP-Link signaled support for tighter standards, calling the rule a step toward improving security while noting plans to expand U.S.-based manufacturing alongside existing operations in Vietnam.

Still, shifting production away from global supply chains presents a major challenge. Even companies that have moved assembly out of China often continue to rely on Chinese-owned facilities or engineering teams, leaving key parts of the supply chain unchanged.

Core elements like firmware development and chipset design are frequently tied to overseas teams, raising concerns about hidden vulnerabilities embedded deep within widely used devices.