Cybersecurity Policy Report, Lawmakers Sound Cyber Alarm Over Chinese Home Routers, (Aug 15, 2024)

By Tom Leithauser

The Commerce Department should use its supply-chain security authorities to investigate whether the widespread use of home networking equipment made by TP-Link poses a national security threat to the U.S., according to leaders of the House Select Committee on the Chinese Communist Party (CCP).

TP-Link has significant roots and operations in China, and its widespread presence in U.S. supply chains for information and communications technology and services (ICTS) presents a “glaring national security issue,” Reps. John Moolenaar (R., Mich.), the committee’s chairman, and Raja Krishnamoorthi (D., Ill.), its ranking member, said in a letter to Commerce Secretary Gina Raimondo.

They noted reports from national security officials in the U.S. and allied nations that the government of the People’s Republic of China (PRC) was using small-office/home-office (SOHO) networking devices to camouflage the source of cyber attacks on critical infrastructure, including the Volt Typhoon campaign that involved pre-positioning malware on critical infrastructure networks to prepare for conflict between the U.S. and China (CPR, July 10).

“TP-Link is the world’s largest provider of Wi-Fi products, selling over 160 million products annually to more than 170 countries, and is a leading SOHO router provider in the United States. TP-Link products are also found on U.S. military bases, with the Army & Air Force Exchange and the Navy Exchange selling these devices to members of the military and their families,” according to the letter, which was dated Aug. 13 and released today.

“TP-Link’s unusual degree of vulnerabilities and required compliance with PRC law are in and of themselves disconcerting. When combined with the PRC government’s common use of SOHO routers like TP-Link to perpetrate extensive cyberattacks in the United States, it becomes significantly alarming,” Reps. Moolenaar and Krishnamoorthi said.

“Given the PRC’s data and national security laws, the proliferation of PRC-made SOHO routers in the United States, and the demonstrated willingness of the PRC government to sponsor hacking campaigns using PRC-affiliated SOHO routers like those made by TP-Link, we request that Commerce verify the threat posed by PRC-affiliated SOHO routers—particularly those offered by the world’s largest manufacturer, TP-Link—and consider using its ICTS authorities to properly mitigate this glaring national security issue,” they said.

“Specifically, we request that you respond no later than August 30, 2024, describing (1) your assessment of the national security risks posed by TP-Link SOHO routers, and (2) your assessment of whether ICTS authorities are appropriate to allay any risks,” they added.

The Commerce Department has the authority, pursuant to a 2019 executive order and a subsequent rulemaking, to conduct case-by-case reviews of national security threats posed by technology products and services offered by companies in adversarial foreign nations.

Commerce recently used that power to ban Kaspersky Lab, a cybersecurity firm based in Moscow, from selling antivirus software and other cybersecurity products and services in the U.S. (CPR, June 21).

TP-Link did not respond to a request for comment.

News: DataSecurity FederalLegislation