Cybersecurity Policy Report, Parties Seek Changes Ahead of FCC Vote on ‘Covered List’ Loophole, (Jul 21, 2026)

By Jeff Williams

Ahead of the FCC’s planned consideration at its public meeting tomorrow of an order and further notice of proposed rulemaking (FNPRM) on the agency’s “covered list” of equipment and services deemed to pose a national security threat to U.S. communications networks, several parties have weighed in to express a variety of concerns and suggest amendments or deletions.

The draft third report and order and third FNPRM in ET docket 21-232 on the FCC’s covered list would extend its prohibition on finished products to component parts, closing what FCC Chairman referred to in a press release as the “component part loophole” (CPR, July 1).

The Commercial Drone Alliance (CDA) urged the FCC to “carefully tailor its approach” regarding equipment authorizations to “address legitimate national security threats without imposing overly broad restrictions that would set back innovation, investment, or growth in the American drone industry,” according to a CDA filing describing meetings its representatives had with staff members from FCC Chairman Brendan Carr’s office and the Office of Engineering and Technology.

Among other things, the group said that requiring all UAS to undergo the equipment certification process currently included in the draft FNPRM, rather than permitting the use of the Supplier’s Declaration of Conformity (SDoC) process, “would impose significant costs and delays on American drone manufacturers without meaningfully advancing national security objectives.”

The FCC should instead require registration of SDoC devices, CDA said.

The group also said the FNPRM should seek information on the transition period U.S. manufacturers would need to implement new requirements.

During a meeting with counsel to Mr. Carr, a representative for eBay, Inc., discussed the difficulties that small businesses, individuals, and others that sell new or used goods through the company could have complying with the proposed rules.

Among other things, eBay recommended that the “marketplace-related obligations of the Third R&O be considered instead as part of the FNPRM, and that, whenever the Commission adopts such requirements, there be a sufficient implementation period that reflects the scale of changes required for marketplaces—at least twelve to eighteen months.”

The company also suggested that the Commission include (1) a safe harbor for reasonable reliance on seller-provided information and prompt actions in response to identified violations; (2) additional guidance from the Commission on distinguishing between certified and SDoC products; (3) improved Commission compliance infrastructure with more complete product-level information; and (4) rules that reflect the unique circumstances surrounding used goods, refurbished products, replacement parts, legacy devices, and the broad inventories of small-scale sellers.

The Coalition to Protect America’s Small Sellers (PASS), which includes eBay, Etsy, OfferUp, Mercari, Whatnot, and Poshmark, said in a letter that the draft order “fails to account for the realities of how online marketplaces operate the secondary market for used and refurbished electronic goods.”

The FCC should abandon provisions in the order and conduct an additional FNPRM regarding “[t]he expansion of the definition of ‘marketing’”; “[t]he FCC ID display requirement”; “[t]he Order’s treatment of component parts and post-sale modifications”; and “implementation timing,” PASS said.

Separately, the National Retail Federation, the Retail Industry Leaders Association, the Information Technology Industry Council, PASS, and Internet Works expressed concerns in a letter that the draft order “lacks adequate input from relevant stakeholders and therefore does not and cannot address the serious real-world implications of its sweeping Marketplace Requirements.”

The requirements would “significantly expand FCC authority across the economy and raise serious legal hurdles and practical implementation problems,” they said.

The Commission should at least “obtain additional information and accurate, adequate data to fully inform its choices by considering these new rules as part of the Third Further Notice of Proposed Rulemaking,” the groups said.

CTIA suggested that the FCC add language to the FNPRM that “generally seeks comment on how the item would impact any other supply chain issues, certifications, or other areas, beyond those specifically discussed in the item,” according to a filing describing a meeting between a CTIA representative and counsel to Mr. Carr.

USTelecom said in a letter that the FCC should add a question to the FNPRM “seeking comment on ‘any other service provider certifications that may be impacted by the determinations in the R&O and proposals in the FNPRM, including but not limited to the component-level prohibitions and the bifurcation of the FCC Covered List.’”

NCTA submitted a letter suggesting edits to the draft order and FNPRM to clarify that online marketplace requirements were “directed to websites functioning as online marketplaces for third-party sellers, rather than provider websites through which FCC-authorized RF devices are offered directly to subscribers for use in connection with subscription services.”

The suggested edits would also clarify the “specific information that online marketplaces must make available at the online point of sale,” NCTA said.

The Computer & Communications Industry Association (CCIA) said in a letter that the FCC’s proposals “would unreasonably extend liability to consumer resale and third party listings on online marketplaces.”

The Commission “should refrain from adopting the proposals until it has worked further with stakeholders to develop compliance obligations that appropriately balance national security objectives with operational realities,” the group said.

Among its concerns, CCIA said that defining “marketing” under the rules to include online marketplaces “would substantially expand compliance obligations by requiring sellers, including ordinary consumers, resellers, and liquidators, to identify and include FCC IDs in every online listing while holding them liable for failing to do so.”

In a meeting with staff members from Mr. Carr’s office and the offices of Commissioners Anna Gomez and Olivia Trusty, representatives of the Consumer Technology Association (CTA) asked the FCC to modify its draft decisions regarding the marketing of RF devices, according to a filing.

CTA called for the FCC to “[p]rovide an appropriate transition period of at least two years for implementing the new FCC ID display requirement that includes grandfathering existing listings and a process for updating the Equipment Authorization System (EAS) database to facilitate compliance”; “[a]dopt a standard for enforcement that allows online marketplaces to rely on a reasonable investigation into the status of products displayed on their platforms, including the representations of third parties”; and “[o]mit changes to the definition of marketing, which are unnecessary to achieve the Commission’s goals and may put the new rules in conflict with other agencies.”

The FCC should also adopt an “appropriate transition period to implement new prohibitions on ‘logic-enabled hardware components,” CTA said.

News: FederalLegislation DataSecurity