A Blanket Ban, Then a Side Door
On March 23, 2026, the FCC's Public Safety and Homeland Security Bureau added every new foreign-made consumer router model to the agency's Covered List, following a National Security Determination that found such devices pose "a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure." The order cited the Volt Typhoon, Salt Typhoon, and Flax Typhoon campaigns — documented, state-linked intrusions that used compromised routers to burrow into U.S. networks. Because virtually the entire consumer router industry — Netgear, Asus, Eero, Google Nest, Linksys, Ubiquiti — manufactures overseas, the order effectively froze new-model authorizations across the market rather than targeting the Chinese-linked firms, like TP-Link, that had originally prompted it.
The FCC built in an escape hatch: manufacturers can apply for "Conditional Approval," a review run jointly through the Department of War and the Department of Homeland Security. To qualify, an applicant must submit "a detailed, time-bound plan to establish or expand manufacturing" in the U.S., with committed capital expenditures and milestones over a one-to-five-year horizon.
Starlink's Four-Month Turnaround
On July 27, 2026, the FCC granted SpaceX Services, Inc. conditional approval for its Starlink routers, effective through February 1, 2028, per the Bureau's public notice — one of roughly a dozen manufacturers, alongside Netgear, Adtran, Calix, Nokia, and several Taiwanese and European contract manufacturers, to clear the process since April. The approval is conditioned on SpaceX "abid[ing] by the onshoring plan outlined in its Conditional Approval application," per the FCC's own filing. Sixteen days later, on August 13, SpaceX moved: it filed its first WiFi 7 Starlink router, the UTR-261, for FCC equipment certification. The router — built in Vietnam, with dual Ethernet ports, USB-C, Power-over-Ethernet support, and theoretical local speeds up to 5.19 Gbps — is the clearest proof yet that the exemption isn't a formality; it's now the mechanism by which Starlink can keep shipping new hardware at all.
The Case for the Ban Is Real
It's worth taking the underlying security concern seriously before critiquing the process built around it. Home and small-office routers are a genuinely underprotected layer of U.S. network infrastructure: they run rarely-patched firmware, sit at the edge of both consumer and small-business networks, and — per the FCC's own determination — have already been used as staging infrastructure in three separate, attributed nation-state campaigns. A national-security review of equipment authorizations for that category of device is not an overreaction, and the Huawei/ZTE precedent on the same Covered List shows the FCC has legal authority to act this way when the risk is documented rather than speculative.
But the Bottleneck Looks Political, Not National
What undercuts the security framing is who is stuck behind it. TP-Link — which holds roughly 20% of the U.S. consumer router retail market, per its own disclosures — split from its Chinese parent between 2022 and 2024 and now operates as TP-Link Systems Inc., headquartered in Irvine, California, and owned by Jeffrey Chao and his wife. The company has spent months arguing it is no longer a Chinese entity and is actively seeking conditional approval. It remains absent from the FCC's approved list, even as Sagemcom (French) and Sercomm and Askey (both Taiwanese) — foreign-headquartered manufacturers with no less overseas exposure than TP-Link — have already cleared review.
If the differentiator were simply "foreign ownership" or "foreign manufacturing," TP-Link's restructuring should have mattered more than it apparently has. What's left is a process that rewards applicants who can present the fastest, most credible capital-expenditure onshoring plan — which is exactly the kind of criterion a vertically integrated, well-capitalized launch and hardware manufacturer like SpaceX is built to clear quickly, and exactly the kind that leaves a mid-sized consumer electronics importer negotiating for months with no published timeline.
The Proportionate Fix
None of this requires abandoning the underlying security review — routers earned the scrutiny. But an opaque, case-by-case exemption queue, adjudicated without published criteria or a public timeline, converts a national-security screen into a de facto licensing regime that advantages whichever applicant has the deepest balance sheet and the most direct line to the reviewing agencies. The FCC does not need to relax the router determination to fix this; it needs to publish the criteria for conditional approval, set a public shot clock for review (the way spectrum auctions and equipment-authorization timelines already work elsewhere in the agency), and report approval and denial reasoning so outside observers — and competitors — can tell whether the process is screening for risk or picking winners. A security regime that can't explain why one restructured, U.S.-headquartered importer is still waiting while a launch-vehicle company's WiFi router cleared in four months isn't proportionate regulation. It's an unaccountable one.