US bans "foreign-made" consumer routers

[i386]

Source: US bans new foreign-made consumer internet routers

It looks like the fcc will ban new "foreign made" consumer router next year, in the article it specifically mentions tp-link as being "problematic" in the past...
tl:dr: all hardware and software should be "made in usa", "foreign" devices will need an approval from the fcc.

There are now questions like: is open source "made in usa" for projects like openwrt or (fresh)tomato?

 

[etorix]

Security may be a real concern, but "Made in…" is hardly the optimal solution.
"US-made" backdoors only!

Next step: A ban on routing to "foreign" sites. All informations sources should get prior approval by the Ministry of Truth FCC.

 

[rtech]

I do not think that legislators are knowledgeable enough to know that you can flash alternative firmware to routing hw therefore rule that everything which not specifically forbidden is allowed.
Enjoy being in gray area as being in spectacle of idiotic lawmakers is not something you want.

 

[Jorge Perez]

If you're complaining about this, you're probably not really knowledgeable enough to put up a reasonable argument.

Asian brands usually have terrible software even if the hardware is great, which regardless of ill intentions usually leak data without even trying.

 

[alaricljs]

The problem with this is it's pointless. The hardware is not the problem, it's the software... and this new stupidity doesn't address that issue.

 

[zzz111]

Does anyone know of any home routers actually manufactured in the us? I think even the Netgear ones I’ve seen say made in china

 

[PigLover]

I think most people don't even know the risk malware in the router poses - or just how common (and frankly frightening) it is. The underlying issue this is trying to address is very, very real.

But this regulation is just a knee jerk overreach and won't really do anything to address the issue(s).

Maybe, with my best rose colored glasses and full of hope, it will generate some positive backlash that results in education, awareness, and a path towards actual solutions to the router malware issues. But probably not . Most likely it just becomes pay-to-play to get onto the waiver list.

 

[etorix]

Does anyone know of any home routers actually manufactured in the us?

See last sentence in the BBC News article linked in the first post.

 

[zzz111]

Is that actually true tho? They don’t say that on their website anywhere anymore. This site says it isn’t anymore (Starlink’s Mesh Makeover: New $40 Router Mini + Gen 3 Router Price Drop | DISHYtech) and you should be able to search this database if you have one to find where it officially is manufactured (https://fccid.io/) I’ve done so in the past and it seems to link official data

they used to advertise “made in America” for a lot of their stuff but i don’t see any of that anymore

 

[rtech]

If regulators would have wanted to solve security issue all consumer router firmware would have mandated to be open source and ideally an OpenWRT and perhaps something else for enterprise hw.

 

[Greg_E]

Jeff Geerling had a video about this on level 2 Jeff channel. I wonder if this will make it harder or easier to buy OPNsence hardware in the US, while not made here, at least it's made in Europe.

 

[Patrick]

I read the doc last night and then again before the Arm event today. I guess my big question is "what is a router?"

For example:

1. Is a mini PC or a laptop a router? For example, when we order an HP PC, it usually comes from outside the US. I can set up Windows as a router, no? I can install WSL and have a Linux router. I can install bare-metal Linux and build a router. I can install a router-based OS, is that a router?
2. What about the NVIDIA GB10? That has 2x high-speed network ports, a 10Gbps network port, and WiFi, and runs Linux. When we ordered the Lenovo PGX, IIRC, it came from China. It is primarily designed for work or residential use, given how portable and low-power it is?
3. What about a switch? For decades, there has been a debate about where some managed switches end and routers begin.
4. What about an unmanaged switch? If it just needs to forward packets between systems, then that might fit the definition.
5. I was in DC for a wedding years ago, and one of the guests asked me about
   - That is a HPE server assembled in the US from components virtually all built outside (IIRC I was told some of the screws and such were made in the US, but I was never able to verify). A server like that could certainly be a router, but it is not designed for residential use. What about if you had an exceptionally high-end residence, though?
6. What about a router where the code and/or software is open source (e.g. OpenWRT) and therefore has most likely had a foreign contribution?
7. What about well-known firewall vendors? I believe vendors like Fortinet manufacture outside of the US?
8. Is a firewall a router? They seem to fit the definition.
9. Is a lower-end Ubiquiti device a consumer device and thus a "router"?
10. What about an automobile with WiFi and a 5G WAN connection? What if it only has 5G for onboard devices? These are intended for road use, but for many automobiles, they follow people so that means they spend half or more of their days sitting at a residential address
11. What about an ADT or other IP security system designed for home use that has a backup 4G/5G network?
12. Biggest question: Is a mobile phone or an iPad? Tethering mode is effectively turning the device into a router, no? If someone works 40 hours a week and there are 168 hours in a week, is it presumed that, even if they do not work from home, they are "primarily" (over 50%) intended for residential use?

I understand the motivation. I am less clear about the definition.
"Routers: For the purpose of this determination, the term “Routers” is defined by National Institute of Science and Technology’s Internal Report 8425A to include consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems."

Here is the report for the above link.

It feels like this is one where you could argue almost every PC and mobile device, or better yet, anything with a WAN connection that is designed to live outside of a data center is a router.

 

[Greg_E]

What about just an AP.

Gli-net stuff is openwrt based. There's a port of OPNsense for arm, so if this was sold with hardware would it fall under the rule? A cwwk box that was sold with OPNsense?

 

[etorix]

@Patrick Some really nice funny questions up there…
Do I understand correctly that only "residential" devices are targeted, so any "foreign-made" router for data centre use is OK? (Of course, those nefarious aliens would never, never ever, think of spying on what's passing through data centres, would they?)

 

[etorix]

If regulators would have wanted to solve security issue all consumer router firmware would have mandated to be open source

Of course, US-contributed open source is an absolute security guarantee:

Backdoors in OpenBSD? Reply hazy, try again

The fallout from last month's allegations that the Federal Bureau of Investigations attempted to deploy backdoors in the OpenBSD operating system are continuing to echo through developer circles, as more potential clues are unearthed. But if anything, these clues tend to muddy the answer to the...

www.computerworld.com

 

[mattventura]

What about just an AP.

I think the issue is this:

"Routers: For the purpose of this determination, the term “Routers” is defined by National Institute of Science and Technology’s Internal Report 8425A to include consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems."

Notice it says "Routers forward data packets" - not the commonly understood definition of "forwards data packets based on layer 3 information". This means it could potentially include APs and even dumb switches, because those also "forward data packets". Hell, it even says "most commonly Internet Protocol" - it doesn't even require it to be IP? This could include things like Zigbee or Zwave, or other things that forward "data packets" that aren't IP.

The "primarily intended for residential use" is the easier out here - you could make a reasonable argument that a particular device is not intended for residential use.

 

[etorix]

How many lawyers understand "layer 3"? How many lawmakers?
To rely on the common definition, you'd need first to define "layer 3" in Legalese.

 

[Greg_E]

How many lawyers understand "layer 3"? How many lawmakers?
To rely on the common definition, you'd need first to define "layer 3" in Legalese.

I'd guess few to none.

 

[kapone]

How many lawyers understand "layer 3"? How many lawmakers?
To rely on the common definition, you'd need first to define "layer 3" in Legalese.

It's quite simple.

Layer 3 is more than Layer 2 and less than Layer 4.

 

[kapone]

I read the doc last night and then again before the Arm event today. I guess my big question is "what is a router?"

For example:

1. Is a mini PC or a laptop a router? For example, when we order an HP PC, it usually comes from outside the US. I can set up Windows as a router, no? I can install WSL and have a Linux router. I can install bare-metal Linux and build a router. I can install a router-based OS, is that a router?
2. What about the NVIDIA GB10? That has 2x high-speed network ports, a 10Gbps network port, and WiFi, and runs Linux. When we ordered the Lenovo PGX, IIRC, it came from China. It is primarily designed for work or residential use, given how portable and low-power it is?
3. What about a switch? For decades, there has been a debate about where some managed switches end and routers begin.
4. What about an unmanaged switch? If it just needs to forward packets between systems, then that might fit the definition.
5. I was in DC for a wedding years ago, and one of the guests asked me about
   - That is a HPE server assembled in the US from components virtually all built outside (IIRC I was told some of the screws and such were made in the US, but I was never able to verify). A server like that could certainly be a router, but it is not designed for residential use. What about if you had an exceptionally high-end residence, though?
6. What about a router where the code and/or software is open source (e.g. OpenWRT) and therefore has most likely had a foreign contribution?
7. What about well-known firewall vendors? I believe vendors like Fortinet manufacture outside of the US?
8. Is a firewall a router? They seem to fit the definition.
9. Is a lower-end Ubiquiti device a consumer device and thus a "router"?
10. What about an automobile with WiFi and a 5G WAN connection? What if it only has 5G for onboard devices? These are intended for road use, but for many automobiles, they follow people so that means they spend half or more of their days sitting at a residential address
11. What about an ADT or other IP security system designed for home use that has a backup 4G/5G network?
12. Biggest question: Is a mobile phone or an iPad? Tethering mode is effectively turning the device into a router, no? If someone works 40 hours a week and there are 168 hours in a week, is it presumed that, even if they do not work from home, they are "primarily" (over 50%) intended for residential use?

I understand the motivation. I am less clear about the definition.
"Routers: For the purpose of this determination, the term “Routers” is defined by National Institute of Science and Technology’s Internal Report 8425A to include consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems."

Here is the report for the above link.

It feels like this is one where you could argue almost every PC and mobile device, or better yet, anything with a WAN connection that is designed to live outside of a data center is a router.

You're thinking like an Engineer.

This ruling is simply about stopping the flow of these cheap, often "something something" riddled boxes that sell on Ebay, Amazon, Ali etc all day. The vast majority of consumers (and lawmakers) do not possess the technical knowhow to assess whether these are or are not security risks. So, a blanket ruling, broad and vague by design is what you get.

That said...there is likely a geo-political factor here. It's China...it's always China...