B (128:54)
As outlined below, today's action does not impact a consumer's. Guys, here it is a consumer's continued use of routers they previously acquired. Nor does it prevent retailers from continuing to sell import or market router models approved previously through the FCC's equipment authorization process. By operation of the FCC's covered list rules, the restrictions imposed today apply to new device models. Okay, wait. It just said today's action does not impact a consumer's continued use of routers they previously acquired, nor does it prevent retailers from continuing to sell import or market router models approved previously through the FCC's equipment authorization process. So in other words, every single one of the existing apparently suddenly untrustworthy routers that everyone in the world already has are going to be left alone where they are. After all, what else can be done? Consumers already own those. This means that foreign manufacturers, which again is to say all router manufacturers because they're all foreign, are prevented from introducing any new router models into the U.S. they're free to keep making the existing routers and they're also presumably free to keep updating those routers firmware which might be used to add new features or eliminate bugs, we would hope, but that would mean that as WI FI technologies continue advancing and requiring support from new chipsets and new radio hardware, newer routers cannot be obtained from traditional foreign suppliers. Okay, that happened Monday afternoon. Fifteen days ago. By the end of that week, the Technology Policy Institute, a Washington based non profit think tank, published an analysis of this action which I think is extremely useful and worth understanding because it compares what just happened to the previously enacted and outwardly similar ban on Huawei and ZTE equipment. For the policy that for the Technology Policy Institute, Scott Walston titled his piece the FCC Got the Router Ban Wrong. It Knew Better. Here's what he explained and reminds us he wrote on March 23, the FCC effectively banned all new foreign made routers from the US Commercial market by adding them to its so called covered list. The action followed a White House convened interagency national Security Determination issued just three days earlier. The Commission took this action with no notice and comment proceeding, no published cost benefit analysis, and without providing a broad transition process for the affected industry. The only path forward for manufacturers is to apply for conditional approval from the Department of Defense or the Department of Homeland Security. I'll note that the the actual documentation about this which I read which requires this con this conditional approval to be obtained is from the US Department of War or the dhs. Scott appears to be choosing to use the Department's earlier name, so he continues. The security concerns, he writes, are real. Chinese state sponsored hacking groups including Volt Typhoon, Salt Typhoon and Flax Typhoon have exploited vulnerabilities in consumer routers to penetrate American networks, conduct surveillance and build botnets for attacks on critical infrastructure. Okay, now I'm I'm not taking issue with what Scott wrote here, but I do want to take the time to note that to the best of my knowledge, none of our current consumer grade routers ship in an inherently vulnerable state. It's true that in years past, meaning more than a decade ago, more than 10 years ago, we were encountering instances and we discussed them on the podcast where, for example, Intel's demonstration only source code for their UPNP implementation was unfortunately dropped directly into routers. This resulted in UPNP being bound to consumer routers wan facing network interfaces essentially by mistake. After delivering a podcast about that the next week, I announced that I had enhanced Shields UPS services to explicitly allow visitors to check for public UPNP exposure. But all of that was fixed back in 2013 and 2014. 12 years ago. the time, many people were exposed that we fixed that we as an industry fixed it Also, back then, as in more than 10 years ago, we encountered instances where ISP provided routers had open ISP admin ports. They were either using weak authentication credentials or known authentication credentials or contained remotely exploitable weaknesses. But for quite some time now, it has only been when a router's user deliberately configures their router to allow external connections and thus to implicitly solicit external attacks, that any of the various Chinese typhoons, Volt, Salt or Flax might have been able to get into users networks through those routers. My point is, for quite some time now, like for the past 10 years, it's been users who have been unwittingly causing these external open port exposure problems. And none of what, none of that, none of those problems would be lessened by routers having domestic points of origin. Thus, nothing the FCC is attempting to do will fix anything that is now broken. Scott continues writing Router security deserves serious attention, but in the past the FCC addressed threats like these in a way that was more targeted, more precisely designed, and better built to survive a legal challenge comparing the FCC's handling of the Huawei and ZTE threat in the 2019 through 2022 to the new router ban reveals what happens when an agency abandons the deliberative process that makes its expertise useful to respond to the national security risks posed by Huawei and zte. The FCC followed a deliberative process and produced a carefully constructed regulatory framework. Congress identified the specific companies as threats in section 889 of the Fiscal Year 2019 National Defense Authorization Act. The FCC designated Huawei and ZTE as national security threats in June of 2020, published its initial covered list in March of 2021, and adopted a Notice of Proposed Rulemaking and Notice of inquiry on June 17, 2021, initiating two separate dockets and inviting public comment. The Commission then adopted a Report and order in November of 2022 with a unanimous 40 vote, and simultaneously issued a further notice of proposed rulemaking, seeking additional comment on issues it hadn't yet resolved. That process took time, but it also produced outcomes that it could never have achieved in a weekend. Now, we could argue that's bureaucracy, and bureaucracy has overhead and it takes time, but what it does is it tends to keep it from making mistakes. And as he said, just deciding to do it over the weekend and then doing it well, you get the kind of things that we've been seeing from this administration for the last, what, year and three months. The comment process, he writes, produced differentiated treatment based on actual risk The FCC did not treat all five Chinese companies identically. It fully banned new Huawei and ZTE equipment, but took a more nuanced approach with Hick Vision, Dawa and Haitara. The FCC agreed with commenters who argued that these companies pose different levels and kinds of risks. The FCC required those three companies to document the safeguards they would put in place and froze their applications pending that review. The router band, by contrast, that is, this one treats a Netgear router assembled in Vietnam identically to a TP link router designed in China. The comment process identified a clear scope. The FCC had to define what counted as covered equipment. For example, it established that handset equipment designed for broadband operation with connection speeds of at least 200kbps fell within the scope of telecommunications equipment, while equipment below that threshold did not. That line was not in the original proposal. It emerged from the comment process as affected companies argued that basic radio equipment should not be treated the same as broadband capable devices. The FCC drew a principled boundary. The router band that we have now draws no such lines. Its definition of produced in a foreign country encompasses any major stage in the process through which the device is made, including manufacturing, assembly, design and development, potentially sweeping in routers designed by American companies and assembled overseas as they all are. The Huawei ZTE response included transition assistance. The FCC's decision imposed real costs on carriers. Rural carriers told the FCC they couldn't afford to remove Huawei and ZTE equipment without financial help. Congress responded by creating the Secure and Trusted Communications Networks reimbursement program, initially funded at a 1.9 billion dollar level, which removed which funded the removal and replacement of insecure equipment from carrier networks. The program has problems such as a lack of evaluation and careful tracking of funds. Okay, maybe some waste, fraud and abuse. But if the cost imposed on a company is due to a government mandate, the government should at least consider how to pay for it. Fortunately, that doesn't apply here. Nothing really changes for consumers, he wrote. The comment process produced legal durability. During the rulemaking, commenters raised constitutional challenges, including arguments that the rules were an unconstitutional bill of attainder, violated the Equal Protection Clause, and amounted to an unconstitutional taking of property. The FCC addressed each of these arguments in its order. Building a Legal Record. When Huawei challenged the related NDAA restrictions in court, a federal district court found the restrictions lawful because the government had demonstrated they reasonably furthered non punitive national security goals. The router ban, meaning what's happened now has no comparable record and former FCC officials have already predicted it will face legal challenge. Also, he writes, the process was iterative. The FCC recognized that its initial rules were a first step and continued refining them. A second report and order clarified that covered equipment includes modular transmitters, proposed a definition of critical infrastructure, and sought further comment on the scope of marketing prohibitions. The agency learned from industry input how supply chains actually work, and adjusted its rules accordingly. None of this happened with the router ban. The White House convened a panel. The panel issued a determination routers bad. Three days later, the FCC implemented it. Although the Secure Networks act leaves the FCC little discretion over whether to add items to the covered list once the White House makes a qualifying determination, the FCC still retains substantial leeway over how to implement the resulting equipment authorization restrictions, including its scope, transition periods, and what guidance it issues for affected parties, meaning it still could have done more, he writes in the Huawei ZTE proceeding. The covered list edition itself was relatively quick, but the FCC spent more than a year designing the designing the implementing rules through a public process. Nothing in the Secure Networks act prevented the FCC from doing the same here. It chose not to. The router ban bears all the hallmarks of a policy that never faced serious analytical scrutiny. And to those who've been watching Washington recently, what a shock. The stated the stated jurisdiction is cybersecurity risk from foreign manufacturing. But the evidence the FCC itself cited undercuts the case for a foreign country of manufacturer approach. According to the Department of Justice, Volt Typhoon primarily targeted Cisco and Netgear routers devices designed by American companies. The routers were vulnerable not because of where they were manufactured, but because those companies had stopped providing security updates for the discontinued models. And I'll just note that's true in the case of Netgear. Volt Typhoon leveraged routers whose firmware had never been updated and was thus very old and also exposed management interfaces which with weak credentials. So again, it's nothing about country of origin, Scott continues. The FBI's own guidance urged router owners to replace end of Life devices, and CISA's mitigation advice to manufacturers focused on secure design and automated updates, not supply chain origin. Salt Typhoon compromised major US Telecommunications carriers through network equipment made by Cisco, though Cisco's own security researchers reported that most intrusions it reviewed involved stolen credentials rather than software vulnerabilities. The National Security Determination includes supporting evidence from nist, CISA and and the FBI and other agencies on router vulnerabilities generally, but none of it perv persuasively establishes that country of Production standing alone is a useful proxy for cyber security risk and agents. Basically the White House just, you know, waved the wand, you know, waved a hand and said, let's outlaw foreign made routers, period. All those bad consumer routers were, you know, we're outlawing them. An agency, he writes, exercising careful judgment, would have noticed this disconnect. If the problem is that manufacturers abandon security updates for older devices, the solution might be to mandate some kind of software maintenance or to require vulnerability disclosures, not a blanket import ban. Organized around the country of manufacture, the FCC has an interdisciplinary expert staff who could have evaluated whether country of origin is actually a useful proxy for cybersecurity risk. Given the speedy timeline, it seems unlikely that meaning three days, it seems unlikely that that they were consulted in any meaningful way. In principle, country of manufacturer could matter in hardware supply chains if a state actor could theoretically compromise hardware during production. This concern is real and deserves a serious policy response. But a blanket ban covering routers from every country on earth is not that response. And a targeted action against manufacturers with documented ties to adversarial intelligence services, combined with supply chain integrity requirements for all manufacturers seeking FCC authorization would address the hardware concern far more precisely. That's roughly what the FCC did with Huawei and zte. But the current ban treats a router from Finland the same as one from China. Making the matter worse is that virtually no consumer grade routers are manufactured in the United States. That only widely cited. The only widely cited exception is some Starlink WI fi routers that SpaceX says are made in Texas. Even major American brands including Netgear, Eero and Google, manufacture their products overseas. The conditional approval process, which is the supposed escape valve, requires companies to disclose their management structure, detail their supply chain and present a plan for onshoring manufacturing to the United States.
