The Covered List is just a breakup letter at scale. Here are the archetypes.
I'm not the flashiest router on the shelf, but I've never sent your DNS queries to a server in Hainan. My firmware is boring. That's the point. I run OpenWrt if you ask nicely. I have a UL listing and I vote in local elections.
Looking for: someone who values transparency over throughput. I'll show you my BOM on the first date.
I have 16 antennas and I don't want to talk about where I was assembled. My firmware updates come from a CDN you can't trace. I cost $149 and I'm worth every penny — if you don't think about it too hard.
I have a 4.7-star rating on Amazon. 12,000 reviews. Three of the Typhoons went through devices just like me but that's not really my fault, is it?
Looking for: someone who doesn't read the packet captures.
Look. I know I have baggage. I know my corporate structure has "layers." I'm working on it. I've hired a compliance team and I'm disclosing my full BOM — every capacitor, every IC, every line of firmware. I have an onshoring plan and a therapist.
The Department of War said I can stay if I show them everything. So here I am. Showing them everything.
Looking for: patience. And maybe a domestic assembly partner.
We had a good thing. I gave you Wi-Fi 6 at a price point nobody else could touch. Yes, there were rumors. Yes, your government told you to stop seeing me. You didn't listen for a while, and honestly? Those were some of our best years.
But now I'm on the List. Not the conditional list. Not the "we can work it out" list. The List list. The one you don't come back from.
I'm not bitter. I'm just going to keep selling in 180 other countries and pretend this doesn't sting.
Remember Y2K? The collective anxiety that every computer on earth would forget what year it was and civilization would collapse?
We're there again. Except this time:
Y2K had a deadline — January 1, 2000. Everyone knew when to panic. The router bug has no deadline because the bug is already deployed in 96% of American homes. The countdown isn't to midnight. The countdown already hit zero and nobody noticed because the firmware looked fine from the outside.
The Y2K vibe was: will the planes fall out of the sky?
The router vibe is: has a foreign intelligence service been watching you argue with your spouse over Zoom for the last three years?
Sleep well.
The Department of Defense has been renamed to the Department of War. I repeat — the Department of Defense has been renamed to the Department of War. This is not a drill. This is branding.
Let's talk about the name change. The United States Department of Defense — established 1947, previously the Department of War (1789 — 1947) — has been re-renamed to the Department of War.
The original rebrand from War to Defense was PR. America had just won WWII. The military-industrial complex was scaling up. "Defense" sounded better at cocktail parties. It implied you were protecting something rather than doing something to someone.
The re-rebrand back to War is — what? Honesty? Vibes? The geopolitical equivalent of "I'm not mad, I'm disappointed"?
Consider the Conditional Approval process. To keep selling routers in America, you apply to the Department of War. Not Commerce. Not the FTC. The Department of War. You fill out forms for the Department of War. You disclose your corporate structure to the Department of War.
The message is not subtle. The message is: we consider your router a weapon.
And honestly? After Volt Typhoon built a botnet out of consumer routers to surveil critical infrastructure? They're not wrong. Your TP-Link is a weapon. The question is just who's holding it.
Look. The FCC released a 47-page order about router supply chains. We're going to talk about it the way it deserves to be talked about.
You need three units to cover the whole house. You're not enough on your own — you know that — so you've brought friends. You hand off seamlessly. Everyone's connected. The throughput is redundant by design. You're ethically non-monogamous and your SSID is "it's complicated."
You don't flirt. You authenticate. WPA3-Enterprise with RADIUS. Every connection is logged, tagged, and time-stamped. You have a management VLAN for foreplay. You've never had a casual connection in your life and you're not about to start. Safeword is 802.1X.
You didn't choose this. Neither did they. You came with the apartment. You're a modem-router combo that nobody asked for. Your admin password is on a sticker on your underside. You have one job and you do it adequately. The spark died years ago but the contract runs through 2027.
You void warranties recreationally. You run DD-WRT or OpenWrt and you have opinions about iptables. In bed you're the one who insists on reading the source before committing. You compile from source. You sign your own certificates. Your partner says "can't we just use the default settings" and you say "the default settings are how empires fall."
You're incredible in bed but nobody can verify that because all the reviews are from accounts that were created yesterday and the firmware phone-home traffic is encrypted to a server in Hainan. You have a 4.8-star rating. Your ex (the FCC) says you're toxic. You say she's overreacting. The Conditional Approval counselor says you both have valid points but also you need to disclose your BOM.
You don't exist yet. You're the theoretical domestic-production, fully-auditable, open-firmware, American-assembled router that this whole order is trying to will into existence. You are the router equivalent of "I'm working on myself." Everyone's rooting for you. Nobody's seen you ship.
The FCC just put every foreign router on the same list as Huawei. Every. Single. One.
TP-Link controls 65% of the US consumer router market. TP-Link is manufactured in China. TP-Link is now on the Covered List. This is the networking equivalent of finding out your long-term partner has been married the whole time.
"Conditional Approval" is the FCC's way of saying "I'm not breaking up with you, I'm giving you 18 months to become a completely different person."
The application requires disclosing your complete corporate structure. For a Chinese company. To the Department of War. I'm sure that conversation will go smoothly.
CISA called routers the "attack-vector of choice." Not a vulnerability. Not a concern. The choice. Like state-sponsored hackers looked at the menu of ways to compromise American infrastructure and said "we'll have the router, please."
Volt Typhoon compromised home routers to surveil power grids and water systems. Your Netgear was doing infrastructure reconnaissance while you watched Netflix. Your router had a side hustle and it wasn't on LinkedIn.
The order defines "production" as manufacturing, assembly, design, and development. If a single firmware engineer in Bangalore touched the code, the entire device is covered. This is the strictest definition of "made in America" since the actual revolution.
96% of Americans use the internet. The FCC just told 96% of Americans that the thing connecting them to the internet might be a foreign intelligence asset. The other 4% are either Amish or prescient.
Your router has a 4.7-star rating, a firmware blob you can't read, and a persistent connection to a server whose location you'll never know. But the Wi-Fi reaches the patio, so.
Here's the thing. All of the above is funny. Some of it is very funny. But underneath the dating profiles and the sex types and the Y2K callbacks, the FCC is saying something real:
The router in your home is a general-purpose computer with root access to your entire network, running firmware you can't inspect, manufactured in a country whose intelligence services have been caught — three times — using exactly this class of device to conduct espionage on American critical infrastructure.
That's not a punchline. That's Tuesday.
The comedy isn't an escape from the seriousness. The comedy is the only way to process the seriousness. Because the alternative is sitting in silence with the knowledge that a nation-state has been living in your firmware and the FCC's response is an 18-month paperwork process.
The Y2K parallel isn't a joke. The Department of War rebrand isn't a joke. The Covered List isn't a joke. They're all real. They're all happening. And your TP-Link is still blinking green in the corner like nothing is wrong.
Which, to be fair, is exactly what a compromised router would do.
See also: routers — core · routers — philosophy · f(s)