You might wonder how it is the FCC regulates Internet routers.

[mattblaze@federate.social]

RE: https://infosec.exchange/@briankrebs/116280575943263005

You might wonder how it is the FCC regulates Internet routers. It's complicated.

First, FCC certification has long been required for virtually all microprocessor-equipped electronics, to ensure compliance with RF emission limits.

Then, in 2020, Congress enacted 47 USC § 1601, the "secure networks act", which requires the FCC to maintain a list of networking equipment determined to pose risks to national security: https://www.law.cornell.edu/uscode/text/47/1601

Equipment on the list can't receive FCC certification.

[mattblaze@federate.social]

So the regulatory authority for the FCC here is rather indirect, kind of a backdoor.

They don't regulate the Internet Protocols or Internet security per se, but they do regulate most of the *equipment* that the Internet runs on (because almost everything uses RF-emitting processors that require FCC certification).

[mattblaze@federate.social]

What the FCC has done here is added *all* foreign made consumer routers (that is, all consumer routers) to the "covered list" of national-security-threatening network gear, unless an exemption is obtained. See https://docs.fcc.gov/public/attachments/DA-26-278A1.pdf

Weirdly, they cite incidents like Salt Typhoon, which compromised carrier-grade equipment, not, as far as I know, consumer routers.

[mattblaze@federate.social]

There will undoubtably be a lot of hairsplitting over definitions here. What constitutes "foreign made"? Assembled overseas? Made of components from overseas? Running firmware written overseas? etc.

[paul_ipv6@infosec.exchange]

@mattblaze

hell, they debated the definition of "is". tech stuff? hopeless.

[alienghic@timeloop.cafe]

@mattblaze

Given this regime my guesses are "foreign made" is some combination of

• hasn't bribed trump
• hasn't included mandatory palantir censorship and surveillance code.

[not2b@sfba.social]

@mattblaze Paid off Trump == domestic, did not pay off Trump == foreign

[mattblaze@federate.social]

Also, this will re-ignite the long standing debate over how to pronounce the word "router".

[gabe@mendeddrum.org]

@mattblaze it rhymes with "scone".

[eltonfc@bertha.social]

@mattblaze I mean, isn't it just like "route" but with the r at the end?

[mattblaze@federate.social]

@eltonfc It's pronounced like "gif".

[run_atalanta@beige.party]

@mattblaze And John Chambers of Cisco Proudly Declared that the corp was going to support the fed with Carnivore and the Patriot Act way back in... whenever.

[pizzademon@mastodon.online]

@mattblaze I wouldn't put too much emphasis on the technical settings underlying the finding. It's the first step towards controlling the domestic Internet. They were going to find a reason.

[jrdepriest@infosec.exchange]

@mattblaze
After dismantling the task force investigating Salt Typhoon.

[mattblaze@federate.social]

@PizzaDemon I'm trying to explain the mechanisms at work here. If you don't find that of interest, no problem, but perhaps others will.

[jima@mspsocial.net]

@eltonfc @mattblaze Ask an Australian to pronounce "router," or "route," and get back to us.

[analog_raccoon@mastodon.social]

@mattblaze
Could Champagne rules apply? (ie, "it's only a 'router' if it's manufactured in the US; otherwise, it's just a 'sparkling network appliance'")

[eltonfc@bertha.social]

@jima are we talking about networking, traffic or woodworking?

@mattblaze

[jima@mspsocial.net]

@eltonfc @mattblaze Yes.