Banned from the market, still on the wall: the FCC’s equipment order and the installed base

The week

The Federal Communications Commission is the federal regulator for anything that sends signals over the air or down a wire. On November 25, 2022, it released an order it had adopted earlier that month under the Secure Equipment Act of 2021. The order stopped the FCC from authorizing new communications equipment from Huawei and ZTE, two large Chinese telecommunications manufacturers.

The timetable came from Congress. The Secure Equipment Act, enacted on November 11, 2021, told the FCC to adopt rules within a year making clear that it would no longer review or approve applications for equipment on its Covered List. The Commission had proposed such rules in June 2021. It adopted the final order on November 11, 2022, a year to the day after the law, and released the text two weeks later.

The Covered List itself came from an earlier statute, the Secure and Trusted Communications Networks Act of 2019, enacted in March 2020. The FCC’s public safety bureau published the first version on March 12, 2021, and updated it in March and September 2022. A company’s equipment lands on the list when one of four statutory national security sources, Section 889 among them, identifies it as a risk. The list was the trigger. The November order attached a new consequence to it.

It went further. Video surveillance and two-way radio equipment from Hikvision, Dahua and Hytera was also barred from new authorization when used for public safety, government facility security, critical infrastructure surveillance or other national security purposes. The rules reached the companies’ subsidiaries and affiliates too, so a change of corporate name would not be enough to slip through.

For those three companies the order set a narrower test than for Huawei and ZTE. Their equipment could be authorized only conditionally, and only after the full Commission approved a plan from each company showing how it would keep the gear out of the restricted uses. The restrictions were to reach every distributor, dealer and reseller, and the equipment had to carry labels stating the prohibition.

The order read “critical infrastructure” broadly. It treated systems tied to the sixteen sectors named in Presidential Policy Directive 21, or to the National Critical Functions maintained with the Cybersecurity and Infrastructure Security Agency, as potentially within scope. That breadth would later be tested in court.

An FCC authorization matters because almost every electronic device that transmits or could interfere with radio signals needs the agency’s sign-off before it can be sold here. Without an FCC authorization, new models cannot lawfully be imported or marketed in the United States. Cutting off authorizations is a way of closing the front door.

The FCC authorizes equipment through two routes. Certification requires an application reviewed by an FCC-recognized certification body. The Supplier’s Declaration of Conformity, used for lower-risk devices, lets the responsible party test the product and declare compliance itself. The order closed both routes for covered equipment, and it required anything from a listed company to go through certification even where the lighter route would normally apply.

Every applicant now had to certify in writing that its equipment was not prohibited, and state whether it was itself a listed entity. Certification applicants also had to name an agent in the United States to receive legal papers. And the order said plainly that rebranding does not change whether equipment is covered. On paper, that closed the most obvious workaround.

But the order was careful about what it did not do. It did not revoke existing authorizations, and it did not require anyone to remove devices already installed. Cameras already screwed to walls, recorders already humming in closets and radios already clipped to belts all remained legal to operate.

The Secure Equipment Act itself had barred the new rules from providing for review or revocation of authorizations granted before they were adopted. The Commission noted that it kept separate discretion to revoke in individual cases, and it opened a further rulemaking on revocation procedures and on questions it had deferred, including whether attestations should reach component parts. The rules took effect on February 6, 2023.

Walk through almost any town hall, school or transit station and look up. Somewhere near the ceiling there is probably a small camera, recording. Few people in the building could tell you who made it, and the order made that question more than trivia.

Washington was not alone that week. On November 24 the British government told its departments to stop deploying Chinese-made surveillance systems on sensitive sites. Two governments had moved against the same class of device within days of each other, and both had stopped short of ordering existing cameras off the walls.

That installed base stayed under older rules, chiefly Section 889 of the defense authorization act for fiscal 2019. Section 889 bars federal agencies from buying such equipment, and from contracting with companies that use it.

So the week’s headline was about what could be sold next. The more pressing question for any public agency, and for the boards and leaders who oversee them, was about what they already owned, and whether anyone actually knew.

Most coverage treated the FCC order as a trade and telecom story, a move in the long contest between Washington and Chinese technology makers. For a public agency, its practical effect was narrower and harder. A rule about what could be sold next left the risk in what was already bolted to walls and poles.

Agencies faced three distinct exposures, each governed by a different rule and each needing a different control: what they buy next, what they already own, and what their contractors and grantees run on their behalf. Each makes more sense once it is clear what these devices are and why their origin matters at all.

Which rule reaches which organization is the first thing to get straight. Federal agencies are bound directly by Section 889 through the Federal Acquisition Regulation. State and local governments, school districts, public hospitals and transit authorities are bound by it mainly when they spend federal grant or loan money, through the federal grant rules at 2 CFR 200.216. The FCC order bound nobody’s purchasing at all. It changed what manufacturers and importers could put on the American market, which in time changes what every buyer can find.

That distinction shapes everything that follows. A federal civilian agency has a contract clause, a reporting duty and an inspector general. A county that buys cameras from its general fund has no federal purchasing ban, though it may face state rules, insurer questions and a grant program that will one day ask. A public health system can fall into both camps at once, depending on which money paid for which building.

Cameras are computers now

A modern security camera, unlike the passive lens of a generation ago, is a small computer with a lens attached. It has a processor, memory, an operating system and a network connection. It stores and sends video, accepts commands, and regularly downloads updates from its maker. In technology terms it is an “internet of things” device, meaning an everyday object that has been given a network connection and a bit of computing power.

Behind the cameras usually sits a network video recorder, a box that collects footage from many cameras and stores it on hard drives. Many recorders and cameras can also connect to a cloud service run by the manufacturer, so staff can watch footage on a phone. “Cloud” here means computers owned by someone else, reached over the internet. That is convenient, but video and control signals may then travel to servers that the agency does not run and may never have looked at.

Two other terms come up often. Firmware is the built-in software that makes a device work, the instructions baked into the hardware. It gets updated from time to time. A system-on-chip is the main processor at the heart of a device, a single chip that does most of the thinking. Two cameras with different brand names on the outside can share the same chip and the same firmware on the inside.

The two-way radios in the order are the handheld and vehicle radios used by police, firefighters, transit staff and maintenance crews. Modern digital radios are also small computers that can be programmed and managed over networks.

How a camera becomes a way in

The ways these devices are abused are well documented, and mostly mundane. The first is exposure. Many recorders ship with a web interface for remote viewing. Installers often open a port on the agency’s firewall so the owner can watch from home, which puts that interface on the public internet.

The second is weak authentication. In 2016 the Mirai botnet took over large numbers of internet-connected cameras and video recorders by trying factory passwords, then used them to knock major websites offline. The devices kept working normally for their owners throughout.

The third is unpatched flaws. In 2021 Hikvision disclosed a serious command-injection flaw in the web server of many of its cameras, tracked as CVE-2021-36260, which let an attacker run commands without logging in. Fixed firmware was released. But cameras are rarely patched on schedule, and a fixed flaw stays open on every device nobody updates.

The fourth is the vendor’s own cloud. Peer-to-peer relay features let a phone app reach a camera behind a firewall without any port being opened. The convenience is real, and so is the result: a path exists that the agency’s firewall rules do not describe. In March 2021 attackers viewed live feeds from roughly 150,000 cameras sold by Verkada, an American company, after obtaining access to its cloud administration tools.

Two conclusions follow. Most of these failures have nothing to do with national origin, and they affect cameras from any maker. But origin decides who controls the update server and the cloud relay. Control of those servers is the one risk an agency cannot fix through its own configuration.

Why does origin matter? A device that sees, hears and connects to your network is only as trustworthy as the people who write its software and run its update servers. If a manufacturer can push new firmware, it can in principle change what a device does. The concern in Washington was not that every such camera was misbehaving. It was that agencies had no reliable way to know, and little say over the answer. The FCC order made that concern official policy.

What agencies buy next

The forward-looking exposure was the easiest to close. Federal buyers had been barred from procuring covered equipment under Section 889 since August 2019. Once new models could not be authorized at all, mainstream distributors had a clear reason to drop them, and the FCC order largely reinforced an existing federal rule.

The gap was relabeling. Low-cost cameras and network video recorders are often sold under other brands while running on hardware or firmware from a covered manufacturer. This is common across consumer electronics: one factory builds the product and many companies sell it under their own names, a practice sometimes called white labeling. A clause that names five companies does not tell a buyer what is inside a box sold under a sixth name.

Supplier self-certification, where the vendor simply signs a statement saying the product is compliant, shifts that question to a reseller who may not know the answer either. A small integrator who buys cameras from a wholesaler may honestly have no idea where the chip or firmware came from.

Three controls work better.

1. Name the real maker. Require bidders to name the original manufacturer of each device and of its main components, such as the system-on-chip and the camera module, with an inaccurate statement treated as a material breach. A material breach is a serious enough violation that the agency can terminate the contract or seek damages, which gives the statement real weight.
2. Follow the updates. Ask for firmware provenance, meaning where the firmware comes from and who signs it. A device’s update server reveals its origin faster than its label. If a camera sold under a domestic-sounding brand phones home to a server operated by a covered manufacturer, that tells you most of what you need to know.
3. Train the buyers. Give acquisition staff a short list of red flags, such as prices well below comparable products or firmware updates delivered from overseas cloud services, that trigger a technical review before award.

A fourth question belongs in every bid: how long the maker will issue security updates for the model, and how the agency will be told when that support ends. A camera bought today will likely outlive its first support commitment. An unsupported device is a liability whatever its origin, so its support end date belongs in the inventory beside the manufacturer.

A procurement officer does not need to become an engineer for any of these, only to know when to call one.

How the federal clauses work

For a federal buyer the machinery is specific. Offerors represent in the System for Award Management whether they provide or use covered equipment, and those that answer yes must give details in the offer. Contract clause 52.204-25 then bars delivering covered equipment and sets a reporting clock.

A contractor that finds covered equipment during performance must tell the contracting officer within one business day, naming the brand, model and any mitigation. Within ten business days it must follow up with further mitigation and the steps taken to prevent a repeat. The clause flows down to subcontracts, including those for commercial products and services, so a prime contractor carries the duty to ask its own suppliers.

The clause has limits that buyers should understand before reading too much into a clean representation. It excludes services that only connect to a third party’s facilities, such as backhaul, roaming or interconnection. It excludes telecommunications equipment that cannot route or redirect user data or give visibility into it. Waivers exist under FAR 4.2104, but they are narrow, and a buyer should not plan around one.

Relabeling after the order

The FCC order helped buyers in one specific way. The Commission stated that rebranding does not change whether equipment is covered. A relabeled recorder from a listed maker is covered in the FCC’s eyes, whatever the case says. That gave procurement offices a federal statement to cite when they asked bidders to name the real maker, and it gave vendors a reason to find out.

Different buyers, different starting points

A federal civilian agency starts with the clauses above and an acquisition workforce trained to apply them. A state agency or a large city usually has a central procurement office. It can add manufacturer and firmware questions to statewide or citywide contracts once, and let every department buy from them.

A small town or school district often buys cameras through an integrator chosen for an installation project, with no technical reviewer involved. For that buyer, the most effective control may be a cooperative purchasing contract whose vetting has already been done. Public hospitals and academic medical centers have a further wrinkle. Their security cameras are often bought with capital funds that blend federal grants, bond proceeds and philanthropy, so the grant rule may apply to one wing and not another.

Each control has a price. Devices whose makers can document components and firmware usually cost more than white-label hardware, and bidders who must document provenance will price that work in. Narrowing the field also lengthens procurement for small buyers. The trade is worth making for cameras on sensitive sites or networks. For a camera watching a salt-storage yard with no network connection, it may not be.

What agencies already own

The installed base was larger and less visible. The order left existing devices legal to operate. Over the previous decade many state and local agencies, school districts, transit authorities and public hospitals had bought networked cameras and recorders without recording the manufacturer as a risk attribute.

Part of the reason is organizational. Facilities teams often bought these devices, not IT. A camera was treated like a door lock or a light fixture, an item of building equipment, not a computer. Many sat on flat networks with default credentials and cloud management accounts nobody monitored.

Those three phrases deserve a moment each. A flat network is one with no internal walls: every device can talk to every other device, so a weak camera can become a stepping stone to a payroll server. Default credentials are the factory username and password, often printed in a public manual, that nobody ever changed. And an unmonitored cloud account is a login, often created years ago by a contractor, that can view or control devices without anyone in the agency watching who uses it.

What changed in November 2022 was that origin became a recognized federal risk signal. Some agencies could not answer from their own records how many cameras they ran, who made them, what firmware they used and which network segments they could reach. Those agencies had no basis for deciding whether to replace, isolate or accept the devices.

The first deliverable was therefore an inventory that put operational technology beside laptops and servers. Operational technology, often shortened to OT, is the equipment that runs physical things: cameras, door controllers, heating and cooling systems, elevators and radios. IT departments have tracked laptops for years. OT often lives on a separate spreadsheet, or nowhere. A useful inventory records manufacturer, firmware version, location, owner and network segment as fields for every device.

Discovery tools help here. Passive network monitoring watches the traffic already flowing on the network without interfering with it. Device fingerprinting recognizes a device by the distinctive way it communicates. Together they identify cameras by their traffic and management interfaces even when the label says something else. A one-time walk-through by facilities staff, matched against what the network sees, usually finds more devices than either source alone.

Discovery carries its own risk. Active scanning can crash older cameras, recorders and building controllers. Teams usually start with passive monitoring and schedule any active scans for maintenance windows, with facilities staff told in advance.

Suppose a county runs a courthouse, two libraries, a jail and a dozen road maintenance depots. Its IT inventory lists about 1,400 laptops and servers and no cameras at all. A facilities walk-through counts roughly 300 cameras. A network scan finds about 340 devices that behave like cameras, including 40 in depots that nobody on the walk-through knew were connected. Of those, a meaningful share turn out to run firmware from a covered manufacturer under three different brand names. The county now has the facts it needs to make a decision, which it did not have a month earlier.

A sequence that works

1. Find what faces the internet. An external scan of the agency’s own address ranges shows any camera or recorder reachable from outside. Those come off the internet first, whoever made them.
2. Reconcile. Combine the facilities walk-through, the network discovery results and purchasing records into one list, and resolve the differences device by device.
3. Classify. Record the original maker and firmware source, flag covered devices, and rank each by what it watches and what it can reach.
4. Contain. Move cameras to their own segment, cut outbound access and change credentials, starting with the highest-ranked locations.
5. Plan. Give every covered device a retirement date and a funding line, and build new-device intake into purchasing and installation so the list stays current.

The order of these steps matters. Agencies that start with the replacement budget tend to argue about money before they know the scope. Agencies that start with internet exposure remove the most urgent risk within days, and they earn credibility for the longer work.

Who owns the answer

Inventories fail most often on ownership, not tooling. A workable split gives facilities ownership of the physical device and its location, IT ownership of its network placement and firmware, and the security office ownership of risk decisions. One named person should own the reconciled list and answer for its accuracy.

The evidence an inspector general, grant monitor or state auditor will ask for is predictable. It includes the dated inventory, the method used to build it, and the reconciliation between walk-through and network scan. It includes a list of covered devices with a disposition for each, and change records showing that new devices are added as they are installed. An inventory that was accurate once and never updated is weak evidence a year later.

Sector shapes the stakes. A health system’s cameras often share networks with clinical devices, and footage of identifiable patients in care areas can count as protected health information under HIPAA. That raises the cost of an unmonitored cloud account. A transit authority’s cameras may feed a police dispatch center, which brings law enforcement access agreements and records rules into the design. A school district’s cameras are often maintained by the same contractor that runs its door access system, so one vendor relationship covers both.

Isolate first, replace on schedule

Once an agency knows what it has, the instinct may be to rip everything out. That is rarely the wisest first move.

Isolation was the sensible interim answer. Consider a camera that can reach only a dedicated recorder on its own segment, with outbound internet access blocked and vendor cloud features disabled. It is a far smaller risk than the same camera on the general network. Segmentation means dividing a network into separate zones with controlled gateways between them.

That work costs a fraction of replacement and reduces risk regardless of who made the device. It also tends to fix the problems that matter whatever the label says, such as default passwords and forgotten cloud accounts.

Replacement could then follow the normal refresh cycle, with covered devices retired first. Cameras and recorders wear out and are replaced every several years anyway. Putting covered devices at the front of that queue, and funding it in the capital plan, turns a political problem into an ordinary budget line.

An emergency removal after an incident or a new mandate costs far more. The FCC’s own rip-and-replace program for small carriers showed this while it waited years for full funding. Those carriers had been told to remove Huawei and ZTE gear from their networks, and the money to pay for it arrived slowly. Unplanned replacement means premium prices, scarce installers and service interruptions, all at once.

What isolation means, device by device

• Put cameras and recorders on a dedicated network segment, with a firewall rule that lets each camera talk only to its recorder.
• Block outbound internet traffic from the segment, including the vendor’s relay and update servers, and close any firewall port opened for remote viewing.
• Give remote viewers access through the agency’s own remote-access service, with individual accounts and multifactor authentication, instead of the vendor’s phone app.
• Change every default password, and record who holds administrator credentials for each recorder.
• Apply firmware updates manually after review, from files the agency downloads and checks, instead of letting devices fetch them.
• Send recorder logs to the agency’s central logging, so a new account or configuration change is visible.

Isolation has costs and limits. Blocking cloud features removes remote viewing that staff may rely on, so the agency has to provide another path or expect workarounds. Manual updates need an owner, and a device left on old firmware behind a firewall still carries known flaws. Isolation also decays, as exceptions added for a vendor visit are never removed. A quarterly review of the segment’s firewall rules against the inventory catches most of that drift.

Radios are harder. Two-way radios run on systems with their own controllers, consoles and repeaters, often shared by several agencies in a region. They cannot be fenced off the way cameras can, and replacing handsets can mean changing the whole system. For agencies with covered radios, the realistic plan is usually to tie replacement to the next system upgrade and to coordinate with the partners who share it.

Disposal needs a line in the plan too. Retired recorders hold footage on their drives, sometimes weeks of it. Replacement contracts should require the drives to be wiped or destroyed with a certificate, and the agency should keep that record with the inventory.

Faster replacement has a fair case in some places. Where a covered camera watches a sensitive area, such as a courthouse holding area, a data center or an emergency operations center, what it sees may justify replacement ahead of schedule. Ranking risk by location, not by device count, shows an agency where that line falls.

What contractors and grantees run

The third exposure was where agencies had the least visibility. Section 889’s second prohibition, in force since August 2020, bars federal agencies from contracting with any entity that uses covered equipment, whether or not it touches the contract.

That last phrase is the surprising one. A contractor’s own offices, warehouses and data centers therefore become a compliance question for the agency that awards the work. A records-storage company with covered cameras in its lobby is a problem for the agency that hires it, even if those cameras never see a single government file.

Federal grant rules carry a parallel restriction on spending grant funds on covered equipment, which reaches state and local recipients and their subrecipients. When a city uses a federal grant to put cameras in a transit station, the restriction follows the money.

The annual representation in the System for Award Management, the federal government’s central registry of companies that want to do business with it, is broad and self-reported. It does not substitute for asking a records-storage contractor, a managed security provider or a building-services vendor what is actually installed in the facilities that serve the agency.

Program offices can add a short equipment questionnaire to onboarding and renewal, ask for the contractor’s own device inventory for covered sites, and reserve a right to audit. A right to audit is a contract clause allowing the agency to inspect the contractor’s records or premises. It is rarely used, but its presence changes how carefully the questionnaire is answered.

When the camera system is a service

Many agencies now buy video surveillance as a hosted service, with cameras on site and footage stored and managed in a provider’s cloud. That model changes the contractor question. The agency needs to know which hardware the provider ships, where footage is stored, who at the provider can view it, and which subcontractors run the infrastructure.

It also needs to know how footage is exported with an intact chain of custody when it becomes evidence. Those answers belong in the contract, with the same consequence for a false statement as the hardware representation.

Different relationships, different questions

Contractors do not all deserve the same questions. A records-storage firm holds government material in its own buildings, so its cameras and door controllers matter. A managed security provider has administrative access to agency networks, so its own network hygiene matters more than its lobby. A building-services vendor may install and maintain the agency’s own cameras, which makes it the likeliest source of relabeled devices. A software firm working remotely may have no relevant equipment at all.

Matching questions to the relationship keeps the burden proportionate and the answers meaningful. The agency should also decide in advance who receives a contractor’s report of covered equipment and what happens next. A report that lands in a contracting officer’s inbox with no plan behind it does little.

Grant offices face a different mechanism. Recipients often buy cameras for schools, transit stations or public buildings with federal money. A single line in grant terms rarely reaches the integrator who installs the equipment. Requiring the recipient to keep invoices that name the original manufacturer, and sampling them during monitoring, puts the obligation where the purchase happens.

The consequences for grantees are financial. Under the federal cost principles, spending on covered equipment is an unallowable cost, so a monitoring finding can mean returning money as well as fixing equipment. In its current form, the grant rule treats acceptance of an award as the recipient’s certification of compliance. That puts the burden on the recipient to know what its integrators install with the funds.

There is a trade-off. Every added representation raises the cost of doing business with government and narrows the field of small suppliers. Agencies that limited deep checks to contracts touching sensitive facilities or networks kept the burden proportionate.

More than paperwork

It would be easy, and a mistake, to file all this under paperwork.

The money is real. Cameras and radios are capital assets with long lives, and a forced, unplanned replacement across hundreds of sites can cost far more than a scheduled one. Knowing what you have lets you spread that cost over years.

The risk is real too, and geopolitics is only part of it. The same weaknesses that make a covered camera worrying, such as default passwords and unmanaged cloud links, make any camera a potential entry point for criminals. Ransomware, the malicious software that locks an organization’s files until a payment is made, often enters through overlooked devices. An agency that cleans up its cameras for origin reasons tends to close those doors as well.

Regulators and auditors increasingly expect organizations to know their assets. An agency that answers a federal grant monitor, an inspector general or a journalist with “we are not sure” has a governance problem as well as a technical one.

Footage is also evidence. Prosecutors and defense lawyers can challenge recordings whose integrity the agency cannot demonstrate. A recorder whose administrative accounts and firmware nobody controls makes a weak witness. Clear ownership, logging and access control support the value of everything the cameras record.

And reputation matters. A story about covered cameras in a school or courthouse travels quickly. An agency that found them, isolated them on day one and funded a plan to replace them tells a very different story from one that learns of its cameras from the newspaper.

The strongest objections

Three objections deserve a serious answer. The first is that origin is a crude proxy for risk. Cameras from American and European makers have had serious flaws and breaches too, and a list of five names says nothing about hundreds of other brands. The objection is correct as far as it goes. It argues for an inventory that records every device’s weaknesses, which is the same inventory the origin question demands.

The second is cost. A small town with a few dozen cameras and no IT staff may reasonably ask why it should spend scarce money on devices that work. The answer is sequencing. Isolation and password changes cost little, replacement can wait for the normal refresh cycle, and most of the work is knowing what is there.

The third is that the federal rules may change, so waiting avoids wasted effort. But every later change moved the same way, toward the installed base and toward components. An inventory is useful under any version of the rules, and waiting only shortens the time available to build one.

An inventory that can answer the question

The agencies in the best position share a recognizable shape. One inventory covers both IT and operational technology. Every device has an owner. Manufacturer and firmware source are recorded fields, not guesses. Cameras live on their own network segment. Procurement asks the right questions before purchase, and contracts carry consequences for wrong answers. Covered devices have a retirement date in the capital plan.

A small set of measures shows whether the program is real. The share of devices with a recorded original manufacturer. The share on a segmented network with outbound internet blocked. The number of covered devices, each with a retirement date and a funding source. The time it takes for a newly installed device to appear in the inventory. A governing board or audit committee can track these each quarter without technical training.

The same inventory answers other questions. When a critical flaw is announced in a camera or recorder model, the manufacturer and firmware fields tell the security team within hours which devices are affected. When an insurer asks about internet-exposed devices, the network segment field answers it. The origin question was simply the first to force the work.

So do the ones that struggle:

• Treating the brand label as the answer, and missing relabeled devices.
• Leaving cameras to facilities and assuming IT is watching them, while IT assumes the opposite.
• Relying entirely on signed vendor statements that nobody checks.
• Waiting for a mandate before planning, then paying emergency prices.
• Applying the heaviest checks to every small contract, and driving away the suppliers the agency needs.

Where the installed-base risk sits

• How many cameras, recorders and two-way radios do we operate, and where is that number written down?
• For each, do we know the original manufacturer and where its firmware updates come from, rather than the brand on the box?
• Are our cameras on their own network segment, with internet access blocked and default passwords changed?
• Which of our contractors serve sensitive programs, and have we asked them what is installed in their own facilities?
• Do we have a funded plan to retire covered devices in our normal refresh cycle, or would we be starting from scratch if a removal mandate arrived?

With hindsight

The policy widened rather than reversed in the years that followed, and each step moved closer to the devices already in place.

Hikvision challenged the 2022 order in the U.S. Court of Appeals for the D.C. Circuit. In April 2024 the court left most of the framework in place but found the Commission’s reading of critical infrastructure broader than the statute supported. It vacated those parts and sent them back for the Commission to align with the statutory language.

For public agencies the ruling changed little. Section 889 and the grant rules were unaffected, and security cameras at government buildings fall within the government facility category under any reading. The narrowing mattered more to private buyers of covered cameras than to town halls.

In December 2024 the annual defense authorization act authorized the FCC to borrow up to $3.08 billion from the Treasury to close the rip-and-replace shortfall for carriers. That was the bill for removing equipment that had already been installed, arriving years after the removal was ordered, and it showed how expensive the installed base can become once policy turns toward it.

Congress had appropriated $1.9 billion for that program in December 2020. Carriers’ approved costs far exceeded it, and the FCC had to prorate allocations, so carriers received only part of what removal would cost. The December 2024 law, signed on December 23, raised the program’s permitted spending to $4.98 billion. Carriers had been required to remove the equipment all the same.

In May 2025 the Commission turned to the authorization process itself. It barred recognition of test labs, certification bodies and accreditation bodies owned or controlled by, or subject to direction from, a prohibited entity. The labs that test devices for the American market had become part of the supply chain question.

On October 28, 2025, the FCC voted to close two gaps in its Covered List rules. It created a process to halt continued import and sale of previously authorized covered devices, reaching models that the 2022 order had left alone. And it barred authorization of covered modular transmitters built into other products. A modular transmitter is a small radio component that a manufacturer drops inside a larger device, so this reached into products that might carry an entirely different name on the outside. The agency also sought comment on extending the restrictions to component parts.

The October order also read “produced by” broadly, to cover substantial control over any major stage of making a device, beyond final assembly. Its process for previously authorized devices requires a public notice and at least 30 days of comment before a decision. The rules took effect on December 26, 2025. They stop further import and marketing of affected models, and they leave current owners free to keep using what they have.

That last limit matters for agencies. Even the 2025 rules did not order anyone to unplug a camera. Removal decisions stayed where the 2022 order left them, with Section 889, grant terms and each agency’s own risk judgment. What changed was the market around the installed base. As restrictions widen, compatible replacements and reseller support for covered lines can become harder to find, which makes the replacement schedule a supply question as well as a budget one.

We know of no federal reimbursement program for state and local video surveillance comparable to the carriers’ program. The cost of replacement stayed with the owners.

Each step moved the line closer to the installed base and to what is inside a product. That is exactly the territory where the 2022 order had left agencies to fend for themselves.

Agencies that had built operational technology into their asset inventories could answer each change quickly. They could say how many affected devices they had, where they were, who owned them and when they were due for replacement. Those relying on supplier representations had to start each inventory from scratch, every time the rules moved.

The habit matters more than China or the FCC. Knowing what you own, down to who made the parts inside it, is cheap to maintain and expensive to rebuild under pressure. Rules about technology origin are likely to keep shifting, and the organizations that keep a living inventory will spend less, move faster and sleep better each time they do.

Organizations should confirm current Covered List entries and contract clauses with counsel, since both have changed.