The IT Nerd

The FCC has added foreign-produced advanced robotic devices to its Covered List, preventing new models from receiving the equipment authorization required for importation, marketing and sale in the U.S. The action follows national security determinations that the products pose unacceptable supply chain and cybersecurity risks.

According to the FCC, network-connected robots could be exploited to manipulate physical operations, collect sensitive data, conduct surveillance or be remotely commandeered, while connected power inverters could create vulnerabilities affecting critical infrastructure.

The restrictions apply only to new device models and do not affect previously authorized products already in the U.S. market.

Matt Wyckhouse. Founder & CEO, Finite State:

“We’re supportive of the FCC’s direction here. Supply chain resilience and onshoring of critical technology manufacturing matter to U.S. national security, and the risks documented in the government’s determinations, remote commandeering, surveillance, pre-installed backdoors, are real, not hypothetical. The additional measure we’d advocate is objectivity: pairing these steps with true security assessment of the devices themselves.

“From analyzing the firmware inside thousands of connected products, we see the same pattern everywhere. Security is a property of engineering, not geography. There is rigorously engineered, secure software coming out of foreign countries, and there is deeply insecure software shipping from U.S. companies. Country of origin is an important input to the risk analysis, particularly where software provenance is hard to establish, but an objective assessment of what’s actually in a device is what separates the secure from the vulnerable. That’s why the FCC’s proposed software and hardware bill-of-materials requirements are an encouraging step, and why pairing them with the substantive security requirements already developed under the Cyber Trust Mark, much as the EU is doing through the Cyber Resilience Act, would give the U.S. an approach that is both resilient and objective: one that strengthens the supply chain while raising the security bar for every device sold here, wherever it’s built.”

Donald McFarlane, Advisory Board Member, Xcape, Inc.

“Taken together with recent guidance from the Five Eyes and other federal agencies, this decision reflects a growing emphasis on the cybersecurity of cyber-physical systems and the resilience of the critical infrastructure that depends on them. We should pay close attention to these signals. They are likely indicative of how governments assess the evolving threat environment and where they see strategic risk increasing.

“Industrial robots are increasingly more than just machines, they are connected computers capable of sensing, deciding, and acting in the physical world. Many of today’s advanced robots have significant operational dependencies on cloud connectivity, AI services, remote management, identity systems, and vendor-operated infrastructure. The security question is not simply whether someone can hack the robot; it’s also what happens if the cloud, the vendor, or the communications path the robot depends on is compromised or unavailable.”

Seemant Sehgal, Founder & CEO, BreachLock:

“The FCC drew a line at the import stage, which is the wrong place to draw it if the goal is reducing risk. There are already authorized devices operating in U.S. networks that carry the same trust relationships, the same firmware update dependencies, and the same remote access capabilities as anything on the new restricted list. Blocking future imports without a plan for what is already inside the perimeter is a procurement policy dressed up as a security measure.”

John Strand, Owner, Black Hills Information Security, Inc.:

“I think these technology-specific bans feel very arbitrary. The security concerns people raise about robotics are the same concerns we’ve had with automobiles, drones, industrial control systems, smartphones, and just about every other connected technology. If it has software, it will have vulnerabilities. That’s simply the reality of modern computing.

“If the standard is that a technology could someday be exploited by a foreign adversary, then almost every technology would qualify. That’s why these policies can feel less like a coherent cybersecurity strategy and more like market protectionism wrapped in the language of national security. The focus should be on building resilient systems, validating software and hardware, and reducing risk regardless of who manufactures the technology, instead of singling out one category while ignoring the fact that the same security challenges exist across the entire technology ecosystem.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“Nation-state attackers have spent a decade moving up the supply chain. Software exploits get patched. Firmware backdoors get caught in audits. Hardware is where verification breaks down, because you cannot audit a fabrication line you do not control.

“That is the security argument behind the FCC adding foreign-produced robots and power inverters to its Covered List this week. Network-connected humanoid robots carry cameras, LiDAR, and persistent connectivity. Inverters sit between solar panels, batteries, data center equipment, and the grid. Both create attack surface that defenders can monitor but cannot fully inspect when the hardware ships from a geopolitical competitor.

“I’ve done enough embedded-device assessments to know that firmware review catches what you can reach, and on hardware imported from an adversary nation, there are layers you simply cannot reach. Software backdoors exist in every copy, find one and you’ve found them all. Hardware is different.

“One unit gets pulled off the line or intercepted in shipping, altered with a modified chip, and put back. Intelligence agencies, including ours, have been doing this for years. You can tear down a sample unit, certify it clean, and have no way of knowing the next unit off the same line hasn’t been touched.

“The FCC has banned three product categories in seven months using the same Secure Networks Act written in 2019 for Huawei and ZTE. Drones in December, routers in March, now robots and power inverters. A White House interagency body issues a National Security Determination, the FCC updates its list, and the ban takes effect without new legislation.

“Watch the Conditional Approval list over the next 90 days. Fifteen non-Chinese UAS vendors cleared approval within months of the drones ban. Netgear and eero passed the router review within a month. Zero Chinese manufacturers have received approval in either category, and that ratio will hold for robots and inverters.”

For the record, China has reacted negatively to this and it sounds like they’re going to retaliate. Therefore it is unlikely that this is over.

The FCC is considering a major expansion of its “Equipment Authorization Program” that could draw software developers, firmware providers, design houses and other technology suppliers into the agency’s regulatory system for the first time.

Under a Third Further Notice of Proposed Rulemaking adopted July 22, applicants could be required to submit signed hardware and software bills of materials (SBOMs) covering the hardware, software and firmware in a device. The disclosure would be required to identify: the  component producer, where components were designed, developed or manufactured, and the percentage of component value associated with each production location. Grantees could also be required to update the information within 30 days of material changes.

Because the FCC’s proposed definition of production includes design and development, the information may need to be collected from suppliers far removed from the company filing the application, including design houses and IP licensors with no direct relationship to that applicant.

Eric Greenwald, General Counsel, Finite State had this comment:

   “The FCC’s proposal would turn equipment authorization from a product review into a supply-chain transparency exercise. Applicants would file a signed HBOM and SBOM covering every component, including hardware, software and firmware, along with information about each component’s producer, place of production and share of value.

   “The applicant would be responsible for the filing, but the information would have to be collected from dozens of suppliers, including design houses and IP licensors with no direct relationship to the filer. That process would be onerous, and the results would not necessarily be reliable. Anyone submitting an application for FCC certification will need a way to verify independently what is actually in the device, down to the firmware.”

This is a good start, but this needs to be enforced strictly. Only then will we see meaningful changes.

UPDATE: Justin Beals, CEO & Founder of Strike Graph, an AI-native GRC and compliance automation platform adds this comment:

“Updated SBOM guidance is necessary, but guidance isn’t the hard part—verification is. Plenty of organizations can produce an SBOM document. Far fewer can prove the components listed in it are still accurate six months later, or that a control mapped to a framework requirement is actually being enforced in production.

This is the same gap we see across CMMC, FedRAMP, and every other framework leaning on SBOMs right now: a static list, filed once, treated as proof of ongoing security. It isn’t. It’s a snapshot.

The organizations that get ahead of this will be the ones building continuous validation into their SBOM process—not just generating the document to check a box, but proving its contents stay true over time. That’s the difference between attestation and evidence.”

You might recall that the FCC made the absolutely stupid decision of banning foreign made routers that are consumer grade. One thing that I missed while writing that story is that by March of next year, any routers that are already out there would be prohibited from getting security updates. That’s straight up a #fail because if this exposes anyone who has a router to getting pwned once updates stop. Which is what this this scheme is meant to protect Americans against.

Well I guess the FCC got a clue because it appears that they have reversed course on this according to Tom’s Hardware:

The Federal Communications Commission announced on Friday, May 8, through its Office of Engineering and Technology (OET), that it was extending temporary waivers allowing certain foreign-produced drones, drone components, and consumer routers to continue receiving software and firmware updates in the United States.

In late 2025 and early 2026, the FCC added these categories of equipment to its “Covered List,” which effectively blocked already-authorized devices from receiving post-approval software and firmware modifications. The agency subsequently issued waivers permitting critical security and functionality updates to continue through January 1, 2027, for drones and drone components, and through March 1, 2027, for consumer routers.

Under the updated waiver, manufacturers of affected devices will now be allowed to continue issuing software and firmware updates until at least January 1, 2029, provided the devices had already been authorized for use in the U.S. before being added to the FCC’s “Covered List.” The extension also broadens the waiver to include certain Class II permissive changes involving software and firmware updates intended to mitigate consumer harm.

At least they have come to their senses on this front. But this is still a dumb idea. If the FCC thinks that router companies will magically teleport their manufacturing to the US and that will somehow make routers safer, they are mistaken. But I guess this is one of these things that the FCC will find out the hard way.

So it seems that the FCC in the United States has decided to ban pretty much every wireless router from being sold in the US. The FCC posted this PDF explaining the decision. But here’s the part that you need to care about:

The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.”

And:

The National Security Determination states that “Production generally includes any major stage of the process through which the device is made, including manufacturing, assembly, design, and development.”

Since no router that I am aware of is built in the US. it means that anything that you could purchase from Best Buy, or get from your ISP, or from companies like Cisco or Ubiquiti is effectively banned. So what does that mean? Well, from what I read it means the following:

• This ban applies to the importation and sale of routers.
• You can continue to use your existing router.

Now there is a lifeline of sorts for router companies. They can apply for an exemption by proving that their devices are safe. What that entails is a bit of a question mark at the moment. But I pretty much assume that router companies are rushing to take advantage of that. On top of that, router companies could get around this by building their gear in the United States. But that could take years to scale up and since labour in the US is more expensive than labour in Asia for example, prices are sure to go up.

So why is the US doing this? It’s likely a reaction to companies like TP-Link having what is perceived to be insecure gear that could be leveraged by threat actors of various descriptions to launch attacks. I mention TP-Link because most of the noise around this has centered around TP-Link being accused of working for Chinese intelligence. But the US is said to have said similar things about other router companies.

What should you do in regards to this issue? Well, if you are in the US and you were considering upgrading to a new router to get say WiFi 7 or better performance or more features, now might be a really good time to upgrade given that the US banned drones from DJI using a similar rationale. Thus supplies may run out quickly whether it’s from your local Best Buy, your ISP, of from companies like Cisco.

This will be very interesting to watch as I am going to guess that this whole scenario may not play out the way that the FCC wants it to.

UPDATE: I have some commentary on this. Starting with Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs had this to say:

   “Supply chain compromise is becoming one of the most serious threat vectors for nation state and advanced intrusion activity targeting critical infrastructure. The FCC’s decision to add foreign manufactured consumer routers to its Covered List reflects a risk the security community has been warning about for years.

   “As endpoint and product security have improved, adversaries have increasingly looked upstream toward manufacturing, firmware, and other supply chain dependencies where compromise can create durable access. The FCC’s citation of Volt Typhoon, Flax Typhoon, and Salt Typhoon is consistent with that concern. Network devices are especially attractive targets because they sit in the path of every packet entering and leaving an environment, and predeployment compromise can be exceptionally difficult to detect and remediate.

   “This ruling applies only to new devices seeking FCC authorization, which shows policymakers are treating this as a structural, long-term risk rather than a one-off enforcement action. The market impact could be significant, given how much of the consumer router market is manufactured overseas. Public reporting has suggested that at least one newer Starlink Wi-Fi router is manufactured in Texas, but the broader reality is that domestic production capacity appears extremely limited.

   “Security leaders should treat this as a procurement signal. If the federal government has concluded that foreign manufactured network hardware can present unacceptable supply chain risk, organizations should be reviewing whether their own vendor diligence, firmware assurance, and hardware sourcing practices reflect that same reality. Every router, switch, and access point in the environment came from a supply chain. Knowing where that hardware was manufactured, who wrote the firmware, and what visibility exists into that process is no longer a theoretical exercise. The geopolitical environment is making these questions urgent, and this ruling is unlikely to be the last of its kind.”

Damon Small, Board of Directors, Xcape, Inc. adds this:

   “This is a massive expansion of U.S. tech protectionism, moving beyond specific Chinese entities like Huawei or ZTE to a blanket ban on all foreign-produced consumer routing hardware. By citing the weaponization of SOHO routers by groups like Volt Typhoon and Salt Typhoon, the FCC is treating the humble home router as a primary vector for national-scale pivot attacks against critical infrastructure.

   “For security leaders, the immediate risk isn’t an overnight “dark start,” but a long-term supply chain squeeze; with over 60% of the market currently dominated by foreign manufacturing, procurement for remote-worker kits and branch offices is about to become significantly more expensive and limited to a handful of “trusted” (likely domestic) vendors.

   “Defenders should audit their current fleet of remote-access hardware and prioritize vendors moving toward U.S.-based manufacturing or those actively seeking DHS “Conditional Approval.” While existing hardware is safe for now, expect insurance carriers and federal auditors to eventually move the goalposts from “legal to use” to “compliant to keep.”

   “The FCC is finally treating home routers like the Trojan Horses they are, though I’m sure “Made in the USA” will magically add 40% to the MSRP and zero to the patch frequency.”

The FCC announced it is creating a national security council to improve US defenses against Chinese cyber-attacks and in an effort to “[win] the strategic competition with China over critical technologies” such as 5G, AI, and quantum computing.

The new FCC chair Brendan Carr said he was establishing the council to focus on the “persistent and constant threats from foreign adversaries, particularly the Chinese Communist party”.

  “These bad actors are always exploring ways to breach our networks, devices, and technology ecosystem. It is more important than ever that the FCC remain vigilant and protect Americans and American companies from these threats,” Carr said.

Carr also mentioned that the council would “pull resources from a variety of FCC organizations” and target mitigating US vulnerabilities to cyber-attacks, espionage and surveillance and reducing supply chain dependence on adversarial states.

The new council is expected to shift focus from individual Chinese entities to a more sectoral approach due to US loopholes, such as a Chinese group changing its name, that allowed threat actors to circumvent punitive actions.

  “The US side, instead of playing up the so-called ‘China threat’, should adopt an objective and rational perception of China. It needs to work with China, under the principles of mutual respect, peaceful coexistence and win-win co-operation, for stable, sound and sustainable development of China-US relations,” said Liu Pengyu, the embassy spokesperson, in learning of the new council.

Evan Dornbush, former NSA cybersecurity expert had this to say:

The FCC announcement to build a China-focused response capability is only a few days old, so it may be too early to understand the first-order tactics (and their effectiveness). This is a bold step. The FCC owns the airwaves, and with so much technology leveraging wireless, from drones using GNSS, to cellular networks using foreign-made 5G routing, to mesh networks coordinating over the managed spectrum, it’s clear the FCC is crucially placed to have impact.

This also gives the FCC a “stick” to match its “carrot”. Over the summer when US telecom carriers revealed that the lawful intercept systems they are obligated to operate (due to CALEA, which is managed by FCC), were exposed to foreign adversaries. The resulting action? Congress gave a $3B hand out to “rip and replace” foreign-manufactured equipment. With that gone, telcos still have vast exposure from old legacy equipment likely vulnerable to both known and zero-day exploits.

What might it take for these companies to upgrade? The new authorities could increase audits and inspections. It could increase stricter fines or other penalties.

And this stick could apply to areas other than telcos. It is common practice for foreign companies to white label through US shell entities to get around various disclosures and other restrictions pertaining to license applications. Tightening up the authorization process to trace the supply chain can perturb aggressors trying to preposition deeply embedded malware.

The Chinese are clearly a threat as demonstrated by their past actions. Thus anything that can be done to counter that threat is a good thing in my mind.

According to a press release from Wednesday, the FCC has officially adopted changes to its data breach notification rules to hold phone companies accountable for protecting sensitive customer information, while enabling customers to protect themselves in the event that their data is compromised.

The FCC order will broaden the commission’s scope of customers’ personally identifiable information that is collected and held by telecommunications carriers and expand the definition of “breach” to include “inadvertent access, use, or disclosure of customer information.”

Customers will now receive notice of a breach within 30 days of discovery unless law enforcement asks for a delay. In addition to contacting the FBI, carriers and providers will also be required to alert the FCC of breaches in addition to their current responsibilities.

The vote follows other new and controversial federal data breach reporting requirements from the SEC and FTC.

Ted Miracco, CEO, Approov Mobile Security had this comment:

   “Mobile devices hold a treasure trove of sensitive data, and the consequences of their compromise can be catastrophic, exposing personal, financial, and even medical information to potential misuse. This underscores the vital importance of the FCC’s updated regulations, which aim to strengthen data breach notifications and protect consumers in an era where safeguarding their information is paramount.”

The key thing here is accountability. You shouldn’t be able to sweep a data breach under the rug. Nor should you be able to drag your feet in terms of when you notify the public. Thus it’s positive that these rules are being changed to match the times that we live in.