Blaming the insecurity of consumer Wi-Fi routers on foreign manufacturers is a red herring, and it’s not going to help revive US manufacturing.

What is 802.11ax (Wi-Fi 6) — Credit: Shutterstock

The Trump-dominated FCC is under the delusion that it can magically restore US-made Wi-Fi manufacturing by blocking all foreign-made consumer routers.

The Federal Communications Commission (FCC) banned essentially all new model consumer Wi-Fi routers built outside the US when there are no—none, nada—US router OEMs. In case you haven’t noticed, the US gave up manufacturing tech goods ages ago because American workers were always annoyingly demanding a living wage. The nerve of some people!

According to the FCC, this must be done because (drum roll, please), “the United States must never be dependent on any outside power for core components—from raw materials to parts to finished products—necessary to the nation’s defense or economy.” FCC chairman Brendan Carr enthusiastically added: “Following President Trump’s leadership, the FCC will continue to do our part in making sure that U.S. cyberspace, critical infrastructure, and supply chains are safe and secure.”

Yeah, about that. Milton Mueller, professor at the University of Georgia and founder of its Internet Governance Project, observed: “The digital economy is global. A router ‘Made in the USA’ likely runs a Linux kernel maintained by global contributors, uses Wi-Fi drivers written in Taiwan, and incorporates open-source libraries managed by developers worldwide.”

That logical argument holds no water for the FCC. Specifically, Carr pointed out that “Foreign-made routers were also involved in the Volt Typhoon, Flax Typhoon, and Salt Typhoon cyberattacks targeting vital US infrastructure.”

Yeah, about that. Sure enough, foreign-made routers were directly involved in all three of these major Chinese state-sponsored cyberattack campaigns. But when you look closer, it’s another story.

In the Volt Typhoon and Flax Typhoon attacks, the routers themselves weren’t compromised because they were foreign-made routers. Far from it! They were compromised because they were unpatched, Internet-exposed, and end-of-life. The router manufacturers were no more guilty of opening the doors to these attacks than Microsoft is for your company’s Windows 7 PCs being hacked in 2026.

Only the Salt Typhoon assault on Cisco IOS XE software, which was running on enterprise-grade routers—specifically, ASR 1000 Series, ISR 4000 Series, and Catalyst 8000 Series edge platforms—can be linked directly to Chinese-made routers.

Guess what, though? You can still buy, use, and deploy this Cisco hardware, which is used as core routers by top American telecoms such as AT&T, Verizon, and T-Mobile. Uncle Joe wants to replace his router with a brand-new Wi-Fi 7 model router? Nope, he can’t do it. Multi-billion-dollar companies decide to replace vital infrastructure routers that carry billions of messages every day? Sure, go for it!

You know, if it were me, I’d be taking a long, hard look at the actual modern enterprise networking gear that we know has been breached. Why isn’t the FCC doing this? Darned if I know.

Even the FCC acknowledges that some of Cisco’s problems have nothing to do with who made the hardware and where it was built. For example, the truly awful CVE-2023-20198 vulnerability, with its CVSS score of 10, was all about a boneheaded security hole in Cisco IOS XE Web UI, not the firmware or hardware.

The FCC argues, however, that consumer routers pose unique risks because they’re deployed in millions of homes with minimal security oversight, thus making them ideal for botnet infrastructure. I can’t argue with that. But that has nothing to do with who made these devices and where.

Blaming it on foreign manufacturers is a red herring. Instead, it has everything to do with people running equipment long after its support date has passed and being lame about upgrading the firmware. Look around your own offices. I’ve seen routers still running Wired Equivalent Privacy (WEP) security today, and WEP’s been busted for over twenty years! It also doesn’t help that OEMs tend to be sloppy about patching their firmware.

The simple truth is that no one has manufactured consumer Wi-Fi routers in the United States for more than 24 years. When Wi-Fi went mainstream in the early-to-mid 2000s, with companies like Linksys and Netgear releasing sub-$100 802.11b routers, both companies had already outsourced their manufacturing.

Today, except for Starlink’s proprietary routers, which are bundled exclusively with Starlink satellite internet service, there are no other routers built in the US. Every brand-name router you’ve ever heard of is made outside the States. They design them here but build them elsewhere. For decades, like it or not, outsourcing has been the American way.

Simply banning people from buying new models isn’t going to help US manufacturing revive any more than tariffs have. For American companies to start building Wi-Fi equipment requires a fundamental shift in our economy. I don’t see that happening.

In the meantime, Wi-Fi users will have no choice but to keep using older equipment. As any security expert will tell you, these routers will fall out of support and become more vulnerable than ever to newly discovered security holes. Good job, FCC, good job.

Steven J. Vaughan Nichols

Why can't we have nice routers anymore?