U.S. Representatives: ‘TP-Link routers pose a national security threat’

John Moolenaar and Raja Krishnamoorthi, two members of Congress, claim that routers from TP-Link are a threat for the national security of the United States. They want Secretary Gina Raimondo of the Department of Commerce to look into the potential cybersecurity risks of the Wi-Fi routers.

TP-Link is a tech company that manufactures Wi-Fi routers, Wi-Fi network devices, Wi-Fi mesh routers, wireless access points, Network Attached Storage (NAS) devices, and related hardware and software components for corporate networks.

According to Representatives Moolenaar and Krishnamoorthi, TP-Link is the world’s largest provider of Wi-Fi devices and its products account for a substantial part of the U.S. market for Wi-Fi routers and related devices.

In a letter addressed to Secretary Raimondo of Commerce, they say TP-Link has an “unusual degree of vulnerabilities” and are at hand with the People’s Republic of China (PRC) government. “When combined with the PRC government’s common use of SOHO [small office/home office] routers like TP-Link to perpetrate extensive cyberattacks in the United States, it becomes significantly alarming,” they warn.

The Congressmen cite FBI Director Christopher Wray, who called Volt Typhoon and other Advanced Persistent Threat (APT) groups ‘the defining threat of our generation’. These threat actors are known for using vulnerabilities in TP-Link’s products in malicious cyber campaigns to attack unsuspecting victims, both in the U.S. and Europe.

“Volt Typhoon and other PRC APT groups are able to threaten U.S. critical infrastructure in large part because of their ability to compromise SOHO routers like those manufactured by TP-Link,” the Representatives point out, calling it a “glaring national security issue”.

That’s why they want Secretary Raimondo to launch an investigation into TP-Link’s potential threat for America’s national security, and consider taking mitigating measures under the Departments of Commerce’s information and communication technology services (ICTS) authorities.

In a statement addressed to Reuters, the Chinese Embassy calls the accusations “groundless speculations and allegations”. TP-Link said the company doesn’t sell any router products in the United States and that its routers don’t have cybersecurity vulnerabilities.