Full Report
The Foundation for Defense of Democracies (FDD) identified that revoking existing equipment authorizations is a national security imperative,... The post FDD urges FCC to revoke existing equipment approvals to close national security gaps in communications supply chain appeared first on Industrial Cyber.
Analysis Summary
# Regulation/Compliance: FCC Equipment Authorization Program Overhaul (Focus on Revocation Authority)
## Overview
This addresses the national security imperative to close supply chain gaps in the Federal Communications Commission (FCC) Equipment Authorization Program by requiring the FCC to gain authority to *revoke* existing equipment authorizations, particularly for devices from entities on the 'Covered List' (e.g., specified Chinese companies), even if the devices were initially approved before recent bans. The core issue is the indefinite legality of previously authorized equipment from security risks.
## Key Details
- Issuing Authority: Federal Communications Commission (FCC), influenced by findings/recommendations from the Foundation for Defense of Democracies (FDD).
- Effective Date: **February 6, 2023**, marked the ban on *new* equipment authorizations from specified Chinese companies (Huawei, ZTE, Hikvision). However, the authority to *revoke* existing authorizations is the focus of remediation efforts.
- Jurisdiction: Telecommunications and electronic devices legally marketed in or imported to the U.S.
- Status: Current rules are under scrutiny; enhanced revocation authority is *needed* but not yet fully established for national security revocations.
## Requirements
### Mandatory Requirements
1. **New Equipment Authorization Ban:** Devices from specified Chinese companies (e.g., Huawei, ZTE) must not receive new equipment authorizations after February 6, 2023.
2. **Current Revocation Limits:** Existing authorizations can currently only be revoked under specific technical circumstances (e.g., technical non-compliance, false statements, unauthorized changes); revocation based purely on the vendor being on the Covered List is currently limited.
3. **Component Clarity (Advocated):** The FCC needs to clarify that the definition of "produced by" a covered entity must include components that were produced, designed, or manufactured by them, not just the final product.
4. **Ownership/Control Standard (Advocated):** Promulgate a comprehensive ownership and control standard, similar to Department of Commerce rules, to prevent adversaries from hiding through component sourcing.
5. **Transparency for Test Labs:** Test labs and certification bodies must adhere to reduced disclosure thresholds (currently 5%) regarding foreign entity ties.
### Recommended Practices
1. **Manufacturer/Importer Transparency:** Manufacturers and importers should be held to similar transparency standards as test labs, disclosing material partnerships with foreign entities, regardless of Covered List status.
2. **Aggressive Information Collection:** The FCC should employ aggressive and far-reaching information collection to monitor foreign adversary ties masked by corporate shells or indirect relationships.
3. **Expanded Pre-Market Review:** Assessments must examine component origins and verify the absence of hidden vulnerabilities stemming from indirect supply chain relationships.
## Affected Organizations
- Industries: Telecommunications, electronics manufacturing, importation, and devices operating on U.S. networks.
- Organization Size: Not explicitly defined; applies to any entity marketing/importing regulated equipment.
- Geographic Scope: United States.
## Compliance Timeline
- **February 6, 2023:** Effective date for banning *new* equipment authorizations from specific prohibited companies.
- **Ongoing Indefinite Period:** Previously authorized devices from prohibited vendors remain legal unless revoked via existing technical non-compliance pathways.
- **Future Deadline (Implied):** Full compliance requiring the implementation of a systematic risk-based framework for revocation and clarity on component sourcing definitions is pending regulatory action by the FCC.
## Implementation Guidance
### Assessment Phase
- **Inventory:** Identify all in-use equipment that received authorization *prior* to February 6, 2023, from vendors now on the Covered List.
- **Component Mapping:** Assess the supply chain dependency for critical components of existing and new devices to determine if they are sourced from Covered List entities (based on clarified definitions).
### Implementation Phase
- **Advocacy/Preparation for New Rules:** Prepare documentation systems to meet anticipated expanded transparency requirements (disclosure of all material foreign partnerships for manufacturers/importers).
- **Supply Chain Hardening:** Begin substituting or mitigating reliance on components originating from known adversaries, even if the final assembly site is compliant.
### Validation Phase
- **Audit Documentation:** Ensure all certification documentation clearly maps component origins and partnership structures to prepare for potential future retrospective revocation reviews.
- **Internal Controls:** Establish internal controls designed around the proposed broader ownership and control standards to proactively manage compliance risks.
## Technical Requirements
- Pre-market security assessments (conducted by approved test labs) must be rigorous, examining component origins to verify the absence of hidden vulnerabilities traceable to Covered List entities, even indirectly.
## Penalties & Enforcement
- Fines: Not explicitly detailed in this document regarding penalties for non-compliance with the *lacking* revocation authority, but the current rules allow revocation for technical non-compliance or misrepresentation. The risk of supply chain infiltration is the primary threat.
- Other Consequences: Continued operation of devices allowing foreign adversaries to "lie dormant, evade detection, and position themselves to cause disruption or conduct espionage" (National Security Risk).
- Enforcement: Currently enforced via technical review mechanisms; the proposed change seeks enforcement via systematic national security risk assessment leading to revocation.
## Related Standards
- **FCC Equipment Authorization Program:** The direct framework being targeted for modification/strengthening.
- **Department of Commerce Rules:** Cited as a model for establishing a comprehensive 'ownership and control standard.'
## Resources
- Official Documentation: FCC Public Documents related to recent rule reviews and cybersecurity mandates (e.g., those addressed by FCC Chairman Carr).
- Guidance Documents: FDD public comments on strengthening the Equipment Authorization Program.
- Tools: None specified, but implied need for advanced supply chain visibility tools.
## Practical Recommendations
1. **Demand Regulatory Action:** Advocate for the FCC to immediately promulgate clear definitions for "produced by" and establish a systematic, risk-based mechanism for revoking existing authorizations tied to national security concerns.
2. **Enhance Supply Chain Due Diligence:** Assume that component sourcing, design contracts, and OEM relationships with identified foreign adversaries represent a compliance failure, even if the final product was initially approved.
3. **Increase Transparency Readiness:** Prepare for mandatory, expanded disclosure requirements for all material partnerships between U.S. importers/manufacturers and foreign entities involved in the supply chain.