FCC Bans Foreign-Made Routers - National Security Alert

What Happened

The U.S. Federal Communications Commission (FCC) has taken a decisive step in bolstering national security by banning the import and sale of all consumer-grade internet routers manufactured outside the United States. This ban, announced on March 23, 2026, identifies foreign-made routers as posing an unacceptable risk to national security. The FCC's covered list now includes all such routers, not just those from specific countries like China. Exceptions are limited to routers that have received conditional approval from the Department of Defense (DoD) or the Department of Homeland Security (DHS).

The FCC's decision stems from concerns that foreign-made routers were implicated in significant cyber-attacks targeting critical infrastructure in the U.S., such as the Volt, Flax, and Salt Typhoon attacks. These incidents highlighted vulnerabilities in the systems that could be exploited by malicious actors, raising alarms about the security of consumer-grade networking devices.

Who's Affected

This ban will predominantly affect consumers and businesses that rely on routers for internet connectivity. Most consumer-grade routers are produced outside the U.S., meaning that the majority of new models will no longer be available for import. Existing routers currently in use will not be impacted, allowing users to maintain their current setups without disruption. However, companies that had previously secured FCC authorization for specific foreign-manufactured devices can continue importing those models.

Shane Barney, CISO at Keeper Security, pointed out that the focus on the country of origin oversimplifies the broader security challenges. He emphasized that routers are high-value control points in networks, often overlooked in traditional security oversight. This can lead to vulnerabilities that attackers can exploit.

What Data Was Exposed

The FCC's ban is a response to the realization that foreign-made routers have been linked to serious cybersecurity threats. The agency noted that these devices were directly implicated in cyber-attacks that targeted essential services, including communications, energy, and water infrastructure. The vulnerabilities exploited in these attacks were often due to manufacturers discontinuing security updates for outdated models, leaving networks exposed.

For instance, in the Volt Typhoon and Salt Typhoon attacks, hackers targeted vulnerabilities in routers from major manufacturers like Cisco and Netgear. These incidents underline the critical need for robust security measures in network infrastructure, especially as many routers are now considered outdated and unsupported.

What You Should Do

For consumers and businesses, the FCC's ban signals a need to reassess their network security strategies. Here are some recommended actions:

• Evaluate Current Equipment: Review existing routers and their security status. Ensure they receive regular updates and patches.
• Consider Alternatives: Look for routers that comply with the FCC's new regulations and are manufactured domestically or have received conditional approval.
• Stay Informed: Keep abreast of any changes in regulations or new products that meet security standards.

As the landscape of cybersecurity evolves, staying proactive about network security will be crucial for safeguarding personal and organizational data. The FCC's ban is just one step in addressing the complex challenges posed by foreign-made technology in the digital age.