The Federal Communications Commission (FCC) has moved to enhance cybersecurity measures by adding foreign-manufactured mobile robots and power inverters to its Covered List as of July 28. This decision effectively restricts new models from obtaining the necessary equipment authorization for importation, marketing, or sale within the United States.
Impact on Existing Devices
While new models face restrictions, previously authorized devices remain unaffected. Consumers can continue using their existing products, and federal entities are not barred from purchasing these items. Moreover, ongoing updates for security and compatibility will remain accessible under FCC regulations, despite the limitations on certification processes for Class I and Class II permissive changes.
On the same day, the FCC’s Office of Engineering and Technology issued a waiver, valid until at least January 1, 2029. This waiver permits software and firmware modifications aimed at patching vulnerabilities and ensuring compatibility across various operating systems.
Conditional Approvals and Definitions
Manufacturers seeking Conditional Approval for their devices must apply through the FCC, with the Department of War (DoW) potentially approving robotic devices and the Department of Homeland Security (DHS) overseeing power inverters. These applications are due by January 1, 2028. Importantly, the restrictions are not brand or country-specific; instead, they apply to any product failing to meet the ‘domestic end product’ criteria under the Buy American standard.
The FCC’s definition of a robot encompasses mechanical devices capable of ground movement and remote operation, weighing over 4.4 pounds, with specifications for communication and data collection. Power inverters, in contrast, involve systems converting currents and equipped with remote communication and monitoring capabilities.
Security Concerns and Research Findings
The FCC’s decision is grounded in national security concerns, as highlighted by recent research findings. Notable reports include instances of unauthorized access to household robot data and a series of security vulnerabilities affecting certain Bluetooth Low Energy devices. Research identified critical exploits allowing unauthorized control over devices, underscoring the potential risks of remote access and control.
For power inverters, the FCC cites risks of remote shutdowns, data breaches, and cyberattacks targeting essential infrastructure. Research from Forescout and the Idaho National Laboratory highlights vulnerabilities in widely used products, raising concerns about supply chain security and the potential for grid instability.
This action marks the FCC’s third comprehensive category inclusion on the Covered List, following similar measures against foreign drones and consumer routers in recent years. The decision is framed as a proactive measure to safeguard the supply chain, despite the absence of confirmed exploitation campaigns against existing devices.
