good luck to all the Internet folks in the US, looks like the FCC just banned all non-US manufactured consumer routers, with all of 3 days warning

https://www.fcc.gov/supplychain/coveredlist
https://www.fcc.gov/sites/default/files/NSD-Routers0326.pdf

h/t @erincandescent for finding this
EDIT: correct h/t to Krebs https://infosec.exchange/@briankrebs/116280575943263005

BrianKrebs (@[email protected])

Whoa, that escalated quickly. This just got sent out by the press folks at the Federal Communications Commission (FCC). The FCC says it has decided that all foreign-made consumer-grade Internet routers are henceforth prohibited from receiving FCC authorization and are therefore prohibited from being imported for use or sale in the United States. "Update Follows Determination by Executive Branch Agencies that Consumer-Grade Routers Produced in Foreign Countries Threaten National Security WASHINGTON, March 23, 2026—Today, the Federal Communications Commission updated its Covered List to include all consumer-grade routers produced in foreign countries. Routers are the boxes in every home that connect computers, phones, and smart devices to the internet. This followed a determination by a White House-convened Executive Branch interagency body with appropriate national security expertise that such routers “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” "The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.” "This action does not affect any previously-purchased consumer-grade routers. Consumers can continue to use any router they have already lawfully purchased or acquired." "Producers of consumer-grade routers that receive Conditional Approval from DoW or DHS can continue to receive FCC equipment authorizations. Interested applicants are encouraged to submit applications to [email protected]." Not sure how many consumer-grade routers will be left for sale if it really is a ban on approvals for any foreign-made consumer routers like they said, and not just a bunch of already restricted Chinese makers like Huawei and ZTE. https://www.fcc.gov/document/fcc-updates-covered-list-include-foreign-made-consumer-routers FCC's "covered list" of "thou shalt not entities": https://www.fcc.gov/supplychain/coveredlist

Infosec Exchange
@q Trying to think of a single COTS router manufactured in the US and failing!
@xferok exactly! if this is followed through the US is fucked...
@q It seems nonsense enough to go mostly unenforced, but I could see it impacting our ability to get data radios for CBTC. I really hope this doesn’t happen.

@xferok well what this does is forbid FCC type approval of any new devices, which they themselves at least are likely to follow

and then the US will slowly run out of importable routers to sell anyone...

@q this seems like a Bad! Idea!
@q Also like, what definition of manufactured are we using? If it relies on chip fabs we’re fucked fucked.

@xferok again, unclear!

but probably the 50% plus 1 rule - that is, more than half the value has to have been added in the US

@q listen boss. the value is the plastic. our customers love that we put the blue and the black plastic together in the United States. What’s inside the plastic? Don’t worry about it boss, just some computer, but the domestic plastic is where the value is.
@xferok gold imregnated plastic, for the betterment of the economy
@q bringing back the glory days of the gold standard. no, not like that. we’re putting it in the plastic.

@xferok @q i mean i guess cisco will just have to raise the price of routers until the "value" they add in the US (i.e. sale price minus price of materials / manufacture) is over half of it

thankfully it already is,

@wxcafe @xferok back to the good old days of a linksys in every home

wait shit Linksys is Foxconn since 2018

@q @xferok well it doesn't apply to consumer grade routers, i thought?
@wxcafe @xferok see the last page of this, it explictly is for that
@q @wxcafe exciting
@xferok @q getting my american friends postal adress so i can still communicate with them once they lose network access
@wxcafe @q my plan is to use whales to communicate across the oceans
@wxcafe @xferok still got a modem PCI card? might come in handy
@q @wxcafe computers are a supply chain risk. gotta ban those too
@q @wxcafe BLUE. AND. BLACK.
@wxcafe @xferok @q They do that anyway, though.
@q @xferok i rather imagine we will see the Conditional Approval process (https://docs.fcc.gov/public/attachments/DA-26-278A1.pdf#page=11) used somewhat liberally, but it will probably also turn into a shakedown: "sure, we'd be happy to approve your new devices; just go invest in this manufacturing facility over here (which someone politically-connected might happen to benefit from)"

@q oh… please…

Consumer-Grade Routers Produced in Foreign Countries Threaten National Security

… äpps like TEMU are worse, they run actual botnets on people’s smartphones.

And most of the DDoS I get are from residential IPs in less tightly-controlled countries (mostly Asia and South America). And american (and asian) clouds, of course.

@q I assume that TAA stuff does meet this requirement so tbh not that big of a deal.
@q @erincandescent lol

/me continues to use a router made 10+ years ago with openwrt
@q As much as I've always wanted to run an enterprise router at my home, I will not dignify the FCC's farce.
@q I guess installing OpenWRT is about to get a whole lot harder.
@q Oh god I'm so cooked.