Bye Bye Bad Chinese Routers

At last, Congress is poised to protect Americans from one of China’s top cyber weapons: cheap network routers. Led by U.S. Representatives Bob Latta (R-OH) and Mary Peltola (D-AK), the House of Representatives Energy and Commerce Subcommittee voted 43-0 to advance the Removing Our Unsecure Technologies to Ensure Reliability and Security or ROUTERS Act.

That’s the good news. The bad news is that U.S. government agencies, including NASA, the General Services Administration and the Department of Defense, reportedly have already purchased routers by Chinese company TP-Link.

Even if Congress passes the ROUTERS Act, this is only the beginning of the effort to protect this country from Chinese digital espionage. More needs to be done. The Department of Defense and the Intelligence Community need to re-examine their own networks to ensure that hackable Chinese routers are removed.

The move by Congress won’t require ripping out routers right away. First, a study will ask the Department of Commerce to figure out the risks of routers “designed, developed, manufactured, or supplied by persons owned by, controlled by or subject to the jurisdiction or direction of China, Russia, Iran, North Korea, Cuba, or Venezuela.” The extensive language is necessary because China is so good at sneaky third-party manufacturing guises.
In a rare display of bipartisanship, the ROUTERS Act moved forward because it is long overdue. Any router made by a bad actor country may contain features that make it a cyber weapon.

When a router with security vulnerabilities boots up, it creates several methods for breaking in. One router, the TP-Link AC1200 Archer C50 (v6) when tested a few years ago made possible denial of service attacks – like Russia used against Estonia back in 2007 and tried but failed to use against Ukraine in 2022. Denial of Service is old school for cyber attacks, but it is still effective. The TP-Link router’s poor security also made it possible for hackers to gain network privileges, leak credentials, and steal data, techniques that allow for far longer and more invasive snooping and malign control.

As the Hudson Institute pointed out, Chinese companies are motivated to sell untrustworthy equipment and Beijing helps them do it “by distorting the market to China’s strategic advantage.” Don’t forget Chinese law mandates that companies assist China’s military with espionage and counter-espionage.

The ROUTERS Act will compel the Commerce Department to investigate and list dangerous foreign products. Once suspicious routers are designated, then, under the 2019 Secure and Trusted Communications Networks Act, the Federal Communications Commission can halt sales in the U.S. market. For example, Huawei and ZTE are already banned due to unacceptable security risks. But new legislation is needed because the ROUTERS Act goes further by requiring the active removal of harmful equipment. 

China is pursuing a national strategy to dominate the advanced technologies that determine economic and military power in the 21st Century. Part of this strategy is to exploit information technologies and networking equipment sold to the world by Chinese companies. 

It’s time for Congress to pass the ROUTERS Act and start the remove and replace process to fortify America’s critical infrastructure.

Dr. Rebecca Grant is a national security analyst based in Washington, DC specializing in defense and aerospace research and national security consulting.