FCC Bans Chinese-Produced Network Equipment Linked to Cyber and Espionage Risks

The U.S. Federal Communications Commission (FCC) has implemented comprehensive new restrictions banning the import and marketing of Chinese-produced telecommunications and surveillance equipment identified as posing significant cybersecurity and espionage risks.

Announced on June 26, 2026, this updated regulation addresses a longstanding loophole that previously allowed companies on the FCC’s “Covered List” to continue selling older, pre-authorized equipment in the United States, despite national security concerns.

FCC Bans Chinese-Produced Network Equipment

The Covered List, maintained under the Secure and Trusted Communications Networks Act, identifies vendors whose products pose a threat to U.S. critical infrastructure.

The latest ruling applies retroactively to firms added to the list in 2024 or earlier, effectively revoking all previous equipment authorizations.

Major affected vendors include Huawei, ZTE, Hikvision, and the Russian cybersecurity firm Kaspersky, all of which have faced scrutiny over alleged links to state-sponsored cyber operations and surveillance activities.

From a technical perspective, the FCC’s decision addresses ongoing risks associated with legacy hardware embedded in telecommunications environments.

Older network devices, even if previously certified, often retain exploitable firmware vulnerabilities, weak encryption practices, and undocumented remote access capabilities.

Security researchers have consistently warned that such equipment can serve as entry points for advanced persistent threat (APT) actors, enabling lateral movement, data exfiltration, and long-term network persistence.

Despite the strict import ban, the FCC has not mandated the removal of equipment already deployed. This creates a complex risk landscape where vulnerable infrastructure may continue to operate within U.S. networks.

Analysts note that while the supply chain restrictions reduce future exposure, existing deployments could still present attack surfaces, particularly in rural or smaller telecom environments that rely heavily on cost-effective legacy hardware.

This regulatory action is part of a broader FCC strategy to strengthen U.S. communications infrastructure against foreign adversarial influence.

In parallel, the commission has introduced new licensing requirements for submarine cable terminal equipment operators to address potential interception or sabotage risks associated with undersea data transmission systems. These controls aim to prevent unauthorized access to critical internet backbone infrastructure, which carries the majority of global data traffic.

Additionally, the FCC has expanded its focus beyond traditional telecom hardware to include emerging technologies with network connectivity.

Recent measures include bans on foreign-produced drones and routers, particularly targeting Chinese manufacturers such as DJI, Autel Robotics, and TP-Link. These devices have been linked in multiple threat intelligence reports to data leakage risks, command-and-control vulnerabilities, and potential misuse in surveillance operations.

The FCC’s increasingly aggressive stance reflects a shift toward viewing telecommunications security as a core component of national defense, amid concerns that other U.S. agencies have slowed enforcement of export controls and entity blocklisting efforts targeting Chinese technology firms.

While the new rules significantly enhance supply chain security, experts argue that additional measures are necessary. Recommendations include prohibiting Covered List entities from operating within U.S. networks under existing service authorizations and limiting interconnection agreements with domestic providers.

Such steps would further reduce the risk of adversarial access to sensitive communications infrastructure, especially given ongoing cyber campaigns attributed to state-linked threat actors.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN