On Thursday, October 22nd, the Federal Communications Commission (FCC) of the United States announced that it has banned two devices containing foreign surveillance chips from entering the US market. These chips are produced by HiSilicon, a subsidiary of Huawei. This move marks the first time that the FCC has exercised its authority under the new regulations.
The FCC released a statement on Thursday, indicating that the devices in question include a car recorder and a wireless video transmitter. The FCC pointed out that these devices use chips manufactured by HiSilicon, a company that has been placed on the US “Covered List,” with its chips deemed to pose security risks.
The commission further noted that HiSilicon had promoted this series of chips by claiming they were “designed for the surveillance market” and featured “built-in facial recognition algorithms”.
FCC Chairman Brendan Carr stated, “FCC will continue to remain vigilant to protect and promote national security in the United States. Any video devices containing surveillance chips produced by entities on the ‘Covered List’ pose a clear and unacceptable risk to the country and its people.”
“We will continue to take strong action, enforce our rules, and ensure the security of American networks,” he added.
Any company importing, marketing, or selling most electronic devices in the United States needs FCC equipment authorization. Over the years, due to evaluations of national security risks, FCC rules have prohibited devices produced by entities on the ‘Covered List’ from receiving authorization. However, prior to this, these rules did not explicitly forbid incorporating components produced by entities on the ‘Covered List’ into other legal devices.
On October 13th, the FCC’s 26-50 Report & Order officially came into effect. This final rule, voted on July 22nd and published in the Federal Register on September 11th, added a prohibition on components in the authorization system: any device containing hardware components produced by entities on the ‘FCC Covered List,’ and if the device cannot be authorized when produced by these entities, it cannot receive FCC equipment authorization and thus cannot enter the US market legally.
Affected components include chips, processors, integrated circuits, Wi-Fi/Bluetooth/cellular communication modules, IoT modules, encryption modules, and various smart subcomponents. Passive elements like casings, resistors, and connection wires are not included.
Typical affected devices include routers, switches, network equipment, surveillance cameras, security systems, walkie-talkies, smartphones, tablets, smart home devices, IoT sensors, base station equipment, and all electronic products requiring FCC certification need to conduct self-checks.
FCC explained that a breached logic component could allow entities on the Covered List to access, intercept, or redirect US communications without the user’s knowledge, posing the same risks as with a restricted device as a whole; malicious logic embedded at the chip level, hidden firmware, or hardware backdoors can compromise every layer of protection above encryption, firewall, and endpoint detection software.
Thursday’s action marks the first time the FCC has enforced actions based on the new regulations. The FCC stated that it will continue to strictly enforce the relevant provisions regarding components from the ‘Covered List.’