#routers

The "covered list" means "banned stuff".

"Routers" refers to consumer routers, not business equipment.

The new change boils down to "new routers cannot be made in other countries at any major step of the design or manufacturing process".

Specifically, new models of router cannot receive FCC authorization to be imported or sold in the US.

This does not impact routers you already own.

This does not impact routers you can already buy here: if the model has already been authorized for sale, it's fine. They can keep making, importing, and selling copies of those routers.

As far as I'm aware, there are no routers that are actually made fully in the US.

Essentially what this does is freeze us in time: we can keep buying the same kinds of routers we already have, but nothing newer than that.

The justification for this move is national security, on two fronts: cyber security and the supply chain.

Routers have always been notoriously insecure. They will continue to be so as long as their actual security is unregulated. Except in California, according to my-friend-said-so*, there are no mandatory security audits of any kind for routers to be sold in the US. You'd think that would be a good place to start.

The FAQ mentions a supply chain vulnerability, which I take to mean "another country holds power over us as long as we are dependent on them". So to avoid the future where a foreign country decides we don't get routers anymore, the feds have decided that we don't get new routers anymore. Brilliant move. Piss off trade partners without actually addressing the problem, since we can and will continue buying the already-approved models, until they're not allowed either (speculation).

Exceptions can be made by DHS (parent of ICE) or DoD/DoWar. On account of the security.

*Friend is a senior security researcher at a prominent cyber sec firm.

So yeah. The administration has vocally pushed to move manufacturing back to the US for money reasons, and they're making this move allegedly for security reasons. I could believe that the security concerns are a legitimate driving force for the decision, but the implementation (trade fuckery instead of mandatory audits for everyone) is dumb in my opinion.

There's an obvious element of "we want to replace the Chinese backdoors with our own", which of course no one will confirm until some poor sod publishes research about it and gets knocked off in the back rooms at an airport while trying to flee the country. Assume that spies are everywhere, because they are, and design your threat model accordingly.

Attackers are actively exploiting a command injection bug in long-unsupported D-Link DSL routers, giving them remote control over exposed devices.

Source: BleepingComputer