ROUTERS Act
Click any stage to learn more about the legislative process.
Would require the National Telecommunications and Information Administration (NTIA) to study national security and cybersecurity risks posed by consumer routers and modems made by companies tied to China, Iran, North Korea, or Russia, and report the findings to Congress within one year.
What this bill would do
What it would do
The bill would direct the Secretary of Commerce, acting through the Assistant Secretary for Communications and Information (the head of NTIA), to conduct a study of national security risks and cybersecurity vulnerabilities posed by consumer routers, modems, and combination modem-router devices that are designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the influence of a "covered country." Covered countries are those listed in 10 U.S.C. § 4872(f)(2) — a provision that includes China, Iran, North Korea, and Russia. The Secretary must consult with appropriate bureaus and offices within the Department of Commerce while conducting the study.
The bill would not itself restrict the sale, use, or import of any devices, and it would not establish any new regulatory authority. Its only operative requirement is the study and a written report to the House Committee on Energy and Commerce and the Senate Committee on Commerce, Science, and Transportation within one year of enactment.
Key provisions
- 1Would direct the Secretary of Commerce, through NTIA, to study national security risks and cybersecurity vulnerabilities of consumer routers, modems, and combo devices tied to covered countries.
- 2Would require the Secretary to submit a report of study findings to the House Energy and Commerce Committee and Senate Commerce Committee within one year of enactment.
- 3Would require the Secretary to consult with appropriate bureaus and offices within the Department of Commerce while conducting the study.
Who would be affected
The bill primarily directs the Department of Commerce and NTIA to carry out the study. American consumers who use home networking equipment, as well as manufacturers and suppliers of consumer routers and modems — particularly those with supply chains or ownership ties to China, Iran, North Korea, or Russia — would be the subjects of the study's inquiry.
Why it matters
If enacted, the study could surface specific cybersecurity vulnerabilities in widely used home networking hardware and lay the groundwork for future regulatory action or purchasing restrictions. Consumers, internet service providers, and device manufacturers with ties to covered countries would have a direct stake in whatever findings and policy recommendations the report produces.
What would change
Agencies directed to act
Effective dates
- Report on study results due to Congress
Funding and costs
Congressional Budget Office estimate
CBO estimates that enacting H.R. 866, the ROUTERS Act, would cost less than $500,000 over the 2025–2035 period, with no significant effect on the federal deficit.
H.R. 866 would require the Department of Commerce to study and report to Congress on national security risks and cybersecurity vulnerabilities posed by consumer routers, modems, and combination devices designed, manufactured, or supplied by organizations owned or controlled by China, Iran, North Korea, or Russia. CBO estimates the cost of implementing the bill — primarily for conducting the study and preparing the report — would be less than $500,000 over the 2025–2035 period, subject to the availability of appropriated funds (discretionary spending, meaning Congress must separately provide the money). The bill would impose no mandates on state, local, tribal, or private-sector entities as defined by the Unfunded Mandates Reform Act.
How implementation would work
The Secretary of Commerce, through NTIA, would conduct the study by consulting relevant bureaus and offices within the Department — such as the National Institute of Standards and Technology or other Commerce cybersecurity offices. No rulemaking or public comment process is prescribed. The sole output is a written report delivered to two congressional committees no later than one year after enactment. The bill sets no methodology, classification level, or enforcement mechanism beyond the reporting deadline.
Legislative status & sources
Latest action
Received in the Senate.
Official CRS summary
Show the CRS summaryHide the CRS summary
This bill requires the National Telecommunications and Information Administration to conduct a study on the national security risks posed by consumer routers and modems (including devices that combine a modem and router) and provide the results of the study to Congress. The study must address devices developed, manufactured, or supplied by persons (i.e., individuals and entities) owned by, controlled by, or subject to the influence of China, Iran, North Korea, or Russia.
Legislative subjects
Computer security and identity theft; Computers and information technology; Congressional oversight; Internet, web applications, social media; Science, Technology, Communications
Committee report
H. Rept. 119-75