U.S. mulls ban on Chinese-made TP-Link routers over security concerns

The U.S. is considering banning the sale of TP-Link internet routers, which are made in China, over concerns the home devices pose a security risk, the Wall Street Journal reported.

Authorities may ban the popular routers, which were linked to Chinese cyberattacks, as early as next year when President-elect Donald Trump takes office, according to the report.

Trump has signaled that he is prepared to take a tough stance on China in his second term in office, including by introducing levies of as much as 60% on Chinese-made goods.

TP-Link says its routers do not account for a majority of the internet router devices in U.S. homes and small businesses. The routers are available for purchase on Amazon.com, where they are a best-seller. Amazon did not immediately respond to CBS MoneyWatch’s request for comment on the potential ban.  

The company’s connectivity products are used by the U.S. Defense Department and other federal government agencies, too,  according to the WSJ.

For its part, TP-Link told CBS MoneyWatch that the company’s “security practices are fully in line with industry security standards in the U.S.”

“We implement rigorous secure product development and testing processes, and take timely and appropriate action to mitigate known vulnerabilities,” a TP-Link spokesperson said in a statement to CBS MoneyWatch.

Many consumer brands targeted by Chinese hackers

The company added that many consumer electronics brands are targeted by China-based hacking groups and that it welcomes “opportunities to engage with the federal government to demonstrate that our security practices are fully in line with industry security standards, and to demonstrate our ongoing commitment to the American market, American consumers and addressing U.S. national security risks.”

The Justice Department is investigating whether the routers’ relatively low price violates a law stipulating that companies can’t sell goods for less than the cost of production, the WSJ reported, citing a person familiar with the matter. On Amazon.com, a handful of router models by T-Link are available for sale with a base model costing around $99. The routers are available for sale through a business unit in California as well. 

In a statement to CBS MoneyWatch, TP-Link said that while it does undercut competitor prices, it does not sell any products below cost. 

Compromised routers

In October, Microsoft published an analysis which found that a Chinese hacking entity had access to a trove of compromised TP-Link routers. 

“CovertNetwork-1658 specifically refers to a collection of egress IPs that may be used by one or more Chinese threat actors and is wholly comprised of compromised devices. Microsoft assesses that a threat actor located in China established and maintains this network. The threat actor exploits a vulnerability in the routers to gain remote code execution capability,” the report explains. 

TP-Link said that it takes “appropriate action to mitigate any vulnerabilities” the company becomes aware of. It has also signed the U.S. Cybersecurity and Infrastructure Security Agency, or CISA, Secure-by-Design pledge.