Interagency Determination on Foreign-Produced Routers
On March 20, 2026, an executive branch interagency body convened by the White House under 47 U.S.C. 1601(c)(1) and 1601(c)(4) issued a National Security Determination regarding networking equipment. The interagency body determined jointly and severally that routers produced in a foreign country, regardless of the nationality of the producer, pose an unacceptable risk to the national security of the United States and to the safety and security of U.S. persons.
The determination specifies that foreign-produced routers should be included on the Federal Communications Commission (FCC) Covered List, unless the Department of War (DoW) or the Department of Homeland Security (DHS) transmits a specific determination to the FCC stating that a given router or class of routers does not pose such risks.
- Determination issued on March 20, 2026, under authorities referenced in 47 U.S.C. 1601(c)(1) and 1601(c)(4).
- Applies to routers produced in foreign countries across major stages of production, including manufacturing, assembly, design, and development.
- Recommends inclusion on the FCC Covered List absent specific counter-determinations from DoW or DHS.
Identified National Security and Cybersecurity Risks
The determination highlights two primary categories of unacceptable risks posed by foreign-produced routers: introducing supply chain vulnerabilities that could disrupt the U.S. economy, critical infrastructure, and national defense; and creating severe cybersecurity risks that could immediately disrupt critical infrastructure and harm U.S. persons.
Foreign-produced routers have been directly implicated in major cyber incidents, including the Volt, Flax, and Salt Typhoon cyberattacks, which targeted American communications, energy, transportation, and water infrastructure. Threat actors have compromised edge devices to modify router configurations, create botnets for distributed denial of service (DDoS) attacks, execute password spraying, and maintain covert persistent access.
- Supply Chain Vulnerability: Dependence on foreign manufacturing disrupts defense, economic stability, and critical communications.
- Cyberattack Vector: Exploitation by Advanced Persistent Threat (APT) actors for lateral network movement, botnet establishment, and espionage.
- Implicated Campaigns: Direct involvement of compromised foreign routers in Volt Typhoon, Flax Typhoon, and Salt Typhoon operations.
Scope, Definitions, and Conditional Approval Process
For the purposes of this determination, routers are defined in alignment with National Institute of Standards and Technology (NIST) Internal Report 8425A to encompass consumer-grade networking devices primarily intended for residential use that forward data packets, most commonly Internet Protocol (IP) packets, between networked systems.
To manage the transition, entities producing routers in foreign countries are encouraged to apply for Conditional Approvals under Annex A. If approved, these Conditional Approvals allow producers to continue receiving FCC equipment authorization while working to address the U.S. government's national security concerns.
- Scope: Consumer-grade and small office networking equipment intended for residential and customer-installed applications.
- Production Scope: Encompasses major lifecycle stages including design, development, assembly, and manufacturing.
- Conditional Approvals: Provides an Annex A mechanism to maintain FCC equipment authorization during remediation efforts.