The Router Ban's Real Problem Isn't Favoritism. It's Firmware.

Back in March the FCC added every foreign-made consumer-grade router to the Covered List. Not a specific vendor. Not a specific country. The whole category.

Since then the exemptions have started rolling in, one product at a time, granted by the Department of War, announced through the FCC's Public Safety and Homeland Security Bureau. A Sercomm Wi-Fi 7 router. A Gryphon parental-control unit. Both cleared through January 10, 2028. And Starlink, whose routers are built in Texas, got theirs.

So the conversation right now is about favoritism. Did SpaceX get a favor? Is this protectionism wearing a national-security jacket?

Those are fair questions. They're also not the ones that are going to bite anybody.

Is this actually about Chinese backdoors?

Here's the thing, it might be.

Favoritism could not be the real problem. It could actually be what they're saying, which is Chinese backdoors. The Executive Branch determination behind this cited Volt Typhoon, Flax Typhoon, Salt Typhoon, and the CovertNetwork-1658 botnet. Those aren't imaginary. If all of your infrastructure in the United States, in people's homes and businesses, relies on products that could be compromised quickly and easily, that is a real Department of Defense problem.

Imagine being able to take down all of the internet with a click of a button. We've seen crazier things happen. You saw the pager stuff between Israel and Lebanon. You saw hacks and quote-unquote innovations where people leveraged technology in a way that wasn't beneficial to the people using it.

So I'll give them this: if everything we run is capable of being shut down by an outside agency or a foreign actor, relying on technology from other locations genuinely puts the United States at a disadvantage. Even though this seems like it could be something of a political play, at the end of the day it does help our strategy for being self-reliant.

That's the strongest version of the argument, and I don't think it's stupid.

So what's the part everyone's missing?

The mechanism.

The rule doesn't confiscate anything. Anything that's existing and sitting there still has the ability to run. Retailers can keep selling models that were already approved. It sounds gentle.

It isn't. Because what it actually says is that they can't do anything new with it.

No more firmware updates, no more software updates to that equipment, which could leave them exposed to a whole other slew of security issues.

Read that twice. A rule justified by botnets and backdoors freezes patching on the exact gear it's worried about.

If you're an ISP or a service provider running equipment on that list and you don't get that exception, there's no way for you to update it. And as attacks on home broadband and broadband equipment get more and more intricate, especially with AI, if people aren't able to patch their equipment it could be pretty devastating.

It really creates a pretty bad security posture for any of the operators using equipment on that list.

Who does the uncertainty actually serve?

I hate to sound like a conspiracy theorist. But follow it back and look at who benefits.

We saw the same thing with tariffs. Every day there's a new tariff, or someone pulling back a tariff, or adding a tariff, or adding a new country, or repealing another country.

The uncertainty that this is creating in the marketplace only really seems to serve the people that are creating this uncertainty.

People like Musk, who have great ties into this administration and who also do manufacturing in the United States, end up in a power position where their stuff gets approved quicker than anyone else. And the rest of us are just left to figure out how much money those other groups are willing to spend.

And remember where this started. When it first popped up, everyone was worried about the TP-Link effect, it seemed like this was only happening so that TP-Link could be pushed out of the market. Ends up that a lot of that money quietly was coming from a couple of very large companies in the United States. If you follow the money, you can see the impetus for making it happen.

Who gets hurt that nobody's counting?

This is the part that keeps nagging at me.

Go back to when the whole thing with Huawei first started. You saw a lot of tribal nations and indigenous people in the United States who were either receiving funding or putting funding together to build out these networks, WiMAX, LTE, 4G, even private 5G. They were trying to build out these networks to serve their communities, and they didn't have all the resources. They didn't have the funding. They didn't have the support structure.

Huawei filled that gap. Different manufacturers filled that gap, for low-cost quality equipment. And they were Chinese-backed.

So when these groups went out and deployed all that equipment, and it seemingly solved the problem for them, now look at how this is going to adversely affect them. This could blow up a lot of those installs. And I don't know how that applies to a tribal nation who isn't part of coverage under the FCC in the first place.

It hasn't blown one up yet. But the mechanism is sitting right there, and nobody's writing that story.

What does this mean for buying decisions?

It means the criteria changed, and not in a direction any engineer likes.

Unfortunately, with the political turmoil in the United States, it's not just about the most capable equipment. It's about the politics behind that equipment.

If you try and look five years down the road, there's really no way to look at this and say with any certainty today what's going to happen. This administration is two years out from being gone, and lord only knows what's going to happen with the FCC when the new administration comes in. Making a big jump like that is really, really scary.

I wouldn't want to be in an ISP or operator's shoes right now with all this turmoil.

Do this

1. Inventory what's actually on the list. Not "what brand is it", which exact models are in your racks and your customers' homes, and whether those models have an exemption. A category ban doesn't care about your relationship with the vendor.
2. Find out where your equipment is manufactured. Not where the company is headquartered. Where the box gets built.
3. Look at where they're spending their money politically. I hate to say that out loud. Do it anyway.
4. Judge your vendor's longevity, not just their spec sheet. Ask whether they can stick with you on a five-year plan, because at the end of the day, it's your customers that matter to you.
5. If you're running Covered List gear without an exception, start pricing alternatives now. Not because you have to rip it out. Because the day you need a security patch is the day you find out you can't get one.
6. Put January 10, 2028 on the calendar. That's when the first conditional approvals terminate, under an FCC and an administration that don't exist yet.

FAQ

Do I have to replace routers I already own?
No. Existing equipment keeps running, and retailers can still sell previously approved models. The restriction is on new equipment going forward, which is exactly why the firmware problem, not the hardware, is the real story.

How does a vendor get an exemption?
Case by case. The Department of War (or DHS) issues a Conditional Approval determining that the device doesn't pose a risk to U.S. national security, and the FCC's Public Safety and Homeland Security Bureau announces it. The underlying authority is the Secure and Trusted Communications Networks Act of 2019.

Is a US-headquartered brand automatically safe?
No. The determination follows manufacturing, not letterhead. That's exactly why Starlink's Texas-built hardware cleared, and why "where is this actually made" is now a procurement question instead of trivia.

What happens when the exemptions expire?
Nobody knows, and that's the point. The first ones terminate January 10, 2028, under a Commission and an administration that don't exist yet.

Sources: FCC DA 26-756 · FCC Covered List update · The Hacker News · Ars Technica

Want this kind of thing weekly, in audio? That's the show.