House passes bill to study routers’ national security risks

Lawmakers say the ROUTERS Act is critical to understanding vulnerabilities in devices exploited by Chinese hackers and other adversaries.

A bill requiring the Department of Commerce to study national security issues posed by routers and modems controlled by U.S. adversaries passed the House on Monday, advancing legislation that lawmakers say is “crucial” to understanding the devices’ cybersecurity risks.

The House has moved quickly on the Removing Our Unsecure Technologies to Ensure Reliability and Security (ROUTERS) Act, which was introduced by Reps. Bob Latta, R-Ohio, and Robin Kelly, D-Ill., in March and advanced out of the chamber’s Energy and Commerce Committee three weeks ago.

The bill, which calls on Commerce’s assistant secretary for communications and information to lead a study into devices that are “designed, developed, manufactured, or supplied” by or subject to the influence of a “covered country,” takes particular aim at China and the state-sponsored hacking campaigns that have plagued U.S. networks.

In remarks on the House floor Monday, Latta said the legislation builds on previous bipartisan efforts to “remove untrusted equipment” from American communications systems. The Ohio Republican pointed specifically to the Secure and Trusted Communications Networks Act of 2019, which blocked Huawei and ZTE equipment from U.S. networks, and the Secure Equipment Act of 2021, which bars the Federal Communications Commission from signing off on equipment from “untrusted vendors.”

National security agencies, including the Office of the Director of National Intelligence and the departments of Justice and Homeland Security, have issued advisories and reports on various threats posed by router and modem vulnerabilities, and how Chinese-sponsored hackers have leveraged those vulnerabilities to launch attacks.

“We should take these reports seriously,” Latta said. “Further, we know that companies with ties to the [Chinese Communist Party] could be forced to support Chinese intelligence activities. We can imagine how they could use vulnerabilities in their equipment to aid these efforts.”

The House passage of the bill, which has a companion in the upper chamber from Sens. Marsha Blackburn, R-Tenn., and Ben Ray Luján, D-N.M., comes at a time when the Chinese-sponsored hacking group Salt Typhoon has been lingering for months in several telecom networks. 

Some of those intrusions have come via Cisco routers, Recorded Future researchers found. Routers have emerged in recent years as an especially popular target for hackers.

“It is crucial that we understand the cybersecurity and national security risks our networks face from equipment that originates from our foreign adversaries,” Rep. Debbie Dingell, D-Mich., said Monday. “This is especially true given that our nation’s communications networks are an integral component to nearly every facet of American life, which also makes them prime targets for attack. This legislation will help us to better protect American families and our country from bad actors who want to carry out malicious attacks.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure