US Federal Communications Commission Bans Foreign-Made Consumer Routers Over National Security Concerns

The United States Federal Communications Commission (FCC) has updated its ‘Covered List‘ to include all consumer-grade routers produced outside the country, blocking new foreign-made models from receiving FCC authorisation and entering the US market.

The decision, announced on 23 March, followed a determination by a White House-convened Executive Branch interagency body that foreign-produced routers “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.”

The move has drawn immediate scrutiny from the cybersecurity community, with observers questioning how many router options will remain available to American consumers given that the vast majority of consumer routers are manufactured overseas.

Supply chain and cybersecurity risks cited

The Executive Branch determination outlined two core concerns. First, that foreign-produced routers introduce “a supply chain vulnerability that could disrupt the US economy, critical infrastructure, and national defence.” Second, that they pose “a severe cybersecurity risk” that could be used to disrupt critical infrastructure and directly harm US citizens.

The FCC’s fact sheet noted that malicious actors have exploited security gaps in foreign-made routers to attack American households, disrupt networks, enable espionage and facilitate intellectual property theft.

Foreign-made routers were also linked to the Volt, Flax and Salt Typhoon cyberattacks that targeted US infrastructure, as reported by CyberDaily.

The ruling referenced the Trump administration’s 2025 National Security Strategy, which stated that “the United States must never be dependent on any outside power for core components, from raw materials to parts to finished products, necessary to the nation’s defence or economy.”

What the ban covers

The restrictions apply only to new device models seeking FCC equipment authorisation. Routers that have already received FCC approval can continue to be imported, sold and marketed. Consumers who have already purchased foreign-made routers are not affected and can continue using their existing devices.

The newest entry on the FCC’s Covered List reads: “routers produced in a foreign country, except routers which have been granted a conditional approval by DoW or DHS.”

The Covered List is the FCC’s register of communications equipment and services deemed to pose an unacceptable risk to US national security. Previous entries include telecommunications equipment produced by Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology and Dahua Technology Company. Kaspersky products, China Mobile and China Telecom were also added to the list.

Under the Secure and Trusted Communications Networks Act, the FCC can only update the Covered List at the direction of national security authorities. The Commission cannot update the list independently and is required to implement determinations made by national security agencies.

Conditional approval pathway

The determination does include an exemption. Router producers can apply for “conditional approval” from the Department of War or the Department of Homeland Security. If those agencies determine that a device does not pose the identified risks, it can still receive FCC equipment authorisation.

FCC Chairman, Brendan Carr, welcomed the ruling.

“I welcome this Executive Branch national security determination, and I am pleased that the FCC has now added foreign-produced routers, which were found to pose an unacceptable national security risk, to the FCC’s Covered List,” Carr stated.

“Following President Trump’s leadership, the FCC will continue to do our part in making sure that US cyberspace, critical infrastructure, and supply chains are safe and secure.”

Follows drone restrictions

The router ban follows a similar pattern to recent restrictions on uncrewed aircraft systems. Following national security determinations in December and January, the FCC added foreign-produced drones and drone components to the Covered List, with limited exemptions for devices on the Defence Contract Management Agency’s Blue UAS Cleared List and components qualifying as domestic end products under the Buy American Standard.

Observers question practical impact

The decision has prompted questions about its practical consequences. As CyberDaily reported, cybersecurity researcher Brian Krebs raised concerns about what would actually be left on shelves for American consumers.

“Not sure what the Federal Communications Commission is thinking here, because banning US consumers from buying consumer-grade routers from hardware makers outside the US doesn’t exactly leave them with many options,” Krebs wrote in a post to LinkedIn.

“Not sure how many consumer-grade routers will be left for sale if it really is a ban on approvals for any foreign-made consumer routers like they said, and not just a bunch of already restricted Chinese makers like Huawei and ZTE.”

Rob Ricci, Research Professor in the Kahlert School of Computing at the University of Utah, suggested the restrictions may be more about leverage than security.

“I suspect the actual reason for this is in the second half of the sentence,” Ricci observed, pointing to the exemption clause allowing devices to receive approval from the Pentagon or Homeland Security Department.

Ricci added that the current administration has used approval processes “to extract all kinds of concessions out of companies,” drawing a parallel to the use of merger approvals to influence media companies.

The Cybersecurity and Infrastructure Security Agency has encouraged organisations to use the Covered List for risk management analysis in their regulatory compliance efforts.

Last Updated on March 27, 2026 by Nick Ross